CVE-2018-1288: Improper Control of Generation of Code in Apache Kafka
Summary
CVE-2018-1288: Improper Control of Generation of Code in Apache Kafka. Affects org.apache.kafka:kafka across 3 version ranges.
>= 0.9.0.0, < 0.10.2.2
>= 0.11.0.0, < 0.11.0.3
>= 1.0.0, < 1.0.1
Fixed in 0.10.2.2, 0.11.0.3 or 1.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kafka is an open-source distributed event streaming platform used for building real-time data pipelines and streaming applications. It provides a high-throughput, fault-tolerant, and scalable messaging system. The vulnerability identified as CVE-2018-1288 affects versions 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0 of Apache Kafka. This vulnerability allows authenticated Kafka users to perform actions reserved for the Broker by creating a manual fetch request, which can interfere with data replication and result in data loss.
Vulnerability Detail
The vulnerability arises due to improper control of the generation of code in Apache Kafka. Authenticated Kafka users can exploit this vulnerability by manually creating a fetch request, enabling them to perform actions that are reserved for the Broker. This interference with data replication can lead to data loss, potentially impacting the integrity and availability of the system. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.9.0.0, < 0.10.2.20.10.2.2 -
>= 0.11.0.0, < 0.11.0.30.11.0.3 -
>= 1.0.0, < 1.0.11.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the fix instructions and upgrade to the fixed versions of Apache Kafka.
Conclusion
The vulnerability in Apache Kafka (CVE-2018-1288) can be mitigated by upgrading to the fixed versions mentioned. It is crucial to promptly address this vulnerability to ensure the security and integrity of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kafka:kafka →
FAQ
Apache Kafka is an open-source distributed event streaming platform used for building real-time data pipelines and streaming applications.
Versions 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0 of Apache Kafka are affected by this vulnerability.
The vulnerability allows authenticated Kafka users to perform actions reserved for the Broker, interfering with data replication and potentially leading to data loss.
The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Kafka.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka.
