CVE-2018-17196
- State
- Published
- Severity
- Not scored
- Published
- Jul 11, 2019
- Updated
- Aug 5, 2024
- Reserved
- Sep 19, 2018
Description
In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
KafkaApache |
|
References
- 109139vdb-entry
- [kafka-commits] 20190802 [kafka-site] branch asf-site updated: Add CVE-2018-17196, fix some links. (#223)mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [kafka-commits] 20200115 [kafka-site] branch asf-site updated: Add CVE-2019-12399 (#250)mailing-list
- [druid-commits] 20200406 [GitHub] [druid] ccaominh commented on issue #9579: Add Apache Ranger Authorizationmailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.mail-archive.com/dev%40kafka.apache.org/msg99277.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [flink-user] 20210703 Re: owasp-dependency-check is flagging flink 1.13 for scala 2.12.7mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.