CVE-2017-12610: Improper Authentication in Apache Kafka
Summary
CVE-2017-12610: Improper Authentication in Apache Kafka. Affects org.apache.kafka:kafka-clients across 2 version ranges.
>= 0.10.0.0, < 0.10.2.2
>= 0.11.0.0, < 0.11.0.2
Fixed in 0.10.2.2 or 0.11.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is an open-source distributed event streaming platform used for building real-time data pipelines and streaming applications. It provides a high-throughput, fault-tolerant, and scalable messaging system. The 'org.apache.kafka:kafka-clients' package is a Java client library for Apache Kafka that allows applications to produce and consume messages from Kafka clusters. This vulnerability affects versions 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1 of the 'kafka-clients' package.
Vulnerability Detail
The vulnerability in Apache Kafka allows authenticated clients to impersonate other users by sending specially crafted protocol messages during SASL/PLAIN or SASL/SCRAM authentication. This can be exploited when using the built-in PLAIN or SCRAM server implementations in Apache Kafka. An attacker with valid authentication credentials can abuse this vulnerability to perform unauthorized actions on behalf of other users, potentially leading to data leakage, privilege escalation, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.10.0.0, < 0.10.2.20.10.2.2 -
>= 0.11.0.0, < 0.11.0.20.11.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the 'kafka-clients' package to the fixed versions.
Conclusion
The vulnerability in Apache Kafka allows authenticated clients to impersonate other users, potentially leading to unauthorized actions and malicious activities. It is crucial to upgrade the 'kafka-clients' package to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kafka:kafka-clients →
FAQ
Apache Kafka is an open-source distributed event streaming platform used for building real-time data pipelines and streaming applications.
Versions 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1 of the 'kafka-clients' package are affected.
This vulnerability allows authenticated clients to impersonate other users, potentially leading to unauthorized actions, data leakage, privilege escalation, or other malicious activities.
To fix this vulnerability, upgrade the 'kafka-clients' package to the fixed versions: 0.10.2.2 or later for versions 0.10.0.0 to 0.10.2.1, and 0.11.0.2 or later for versions 0.11.0.0 to 0.11.0.1.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the 'kafka-clients' package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka-clients.
