CVE-2021-38153
Timing Attack Vulnerability for Apache Kafka Connect and Clients
- State
- Published
- Severity
- Not scored
- Published
- Sep 22, 2021
- Updated
- Aug 4, 2024
- Reserved
- Aug 6, 2021
Description
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Scores
The record has no CVSS score.
Weaknesses
- CWE-203 Observable Discrepancy
Affected Products
| Product | Versions |
|---|---|
Apache KafkaApache Software Foundation |
|
References
- https://kafka.apache.org/cve-list
- [kafka-dev] 20211007 Re: CVE Back Port?mailing-list
- [kafka-dev] 20211012 [VOTE] 2.6.3 RC0mailing-list
- [kafka-users] 20211012 [VOTE] 2.6.3 RC0mailing-list
- [kafka-users] 20211012 [VOTE] 2.7.2 RC0mailing-list
- [kafka-dev] 20211012 [VOTE] 2.7.2 RC0mailing-list
- [kafka-users] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0mailing-list
- [kafka-dev] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.