p PatchFirst

CVE-2021-38153

CVE-2021-38153 · Timing Attack Vulnerability for Apache Kafka Connect and Clients

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

CVSS 5.9 · Medium · EPSS 6.2%

Published
Updated

Stack: system

Affected products and versions

  • apache kafka

    Versions
    • ≥ Apache Kafka 2.0.x, ≤ 2.0.1: Affected (custom)
    • ≥ Apache Kafka 2.1.x, ≤ 2.1.1: Affected (custom)
    • ≥ Apache Kafka 2.2.x, ≤ 2.2.2: Affected (custom)
    • ≥ Apache Kafka 2.3.x, ≤ 2.3.1: Affected (custom)
    • ≥ Apache Kafka 2.4.x, ≤ 2.4.1: Affected (custom)
    • ≥ Apache Kafka 2.5.x, ≤ 2.5.1: Affected (custom)
    • ≥ Apache Kafka 2.6.x, ≤ 2.6.2: Affected (custom)
    • ≥ Apache Kafka 2.7.x, ≤ 2.7.1: Affected (custom)
    • ≥ Apache Kafka 2.8.x, ≤ 2.8.0: Affected (custom)

    No fix published

  • kafka Ubuntu:Pro:18.04:LTS

    Versions
    • 2.2.0u2-0ubuntu3.1
    • 2.2.0u2-0ubuntu3.2
    • 2.2.2u1-0ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →