CVE-2018-17196: Improper Input Validation in Apache Kafka
Summary
CVE-2018-17196: Improper Input Validation in Apache Kafka. Affects org.apache.kafka:kafka versions >= 0.11.0.0, < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Kafka is an open-source distributed event streaming platform used for building real-time data pipelines and streaming applications. It provides a high-throughput, fault-tolerant, and scalable messaging system. The vulnerability identified as CVE-2018-17196 affects Apache Kafka versions between 0.11.0.0 and 2.1.0. This vulnerability allows authenticated clients with Write permission on the respective topics to bypass transaction/idempotent ACL validation. It is important to note that only authenticated clients with the necessary permissions can exploit this vulnerability.
Vulnerability Detail
The vulnerability in Apache Kafka versions between 0.11.0.0 and 2.1.0 allows for the manual crafting of a Produce request that bypasses transaction/idempotent ACL validation. This means that an attacker with Write permission on the relevant topics can exploit this vulnerability. The impact of this vulnerability can be significant, as it allows an attacker to perform unauthorized actions within the Kafka system. However, upgrading to version 2.1.1 or later resolves this vulnerability.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache Kafka.
Conclusion
The vulnerability in Apache Kafka versions between 0.11.0.0 and 2.1.0, identified as CVE-2018-17196, allows authenticated clients with Write permission on the respective topics to bypass transaction/idempotent ACL validation. Upgrading to Apache Kafka version 2.1.1 or later resolves this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kafka:kafka →
FAQ
Apache Kafka is an open-source distributed event streaming platform used for building real-time data pipelines and streaming applications.
Apache Kafka versions between 0.11.0.0 and 2.1.0 are affected by this vulnerability.
Only authenticated clients with Write permission on the respective topics can exploit this vulnerability.
The vulnerability allows an attacker to bypass transaction/idempotent ACL validation and perform unauthorized actions within the Kafka system.
To fix this vulnerability, it is recommended to upgrade to Apache Kafka version 2.1.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kafka:kafka.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
