PT-2019-6216 · Apache · Apache Kafka

Publicado 2019-07-10 · Atualizado 2022-05-24 · CVE-2018-17196

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 0.11.0.0 through 2.1.0

Description The issue is related to insufficient access control in Apache Kafka when using Access Control Lists (ACLs). It allows an attacker to bypass security restrictions by crafting a special request. Only authenticated clients with Write permission on the respective topics can exploit this issue.

Recommendations For Apache Kafka versions 0.11.0.0 through 2.1.0, upgrade to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting Write permission on topics to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-264

CWE-20

Identificadores relacionados

BDU:2022-03778

CVE-2018-17196

GHSA-47W3-66WQ-CPXG

Produtos afetados

Apache Kafka

Referências · 28

• https://osv.dev/vulnerability/CVE-2018-17196 · Aviso do Fabricante
• https://lists.apache.org/thread.html/d1581fb6464c9bec8a72575c01f5097d68e2fbb230aff24622622a58%40%3Ccommits.kafka.apache.org%3E · Nota
• https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E · Nota
• https://ibm.com/blogs/psirt/security-bulletin-apache-kafka-as-used-by-ibm-qradar-siem-is-vulnerable-to-information-disclosure-cve-2021-38153-cve-2018-17196 · Nota
• http://securityfocus.com/bid/109139%20Third%20Party%20Advisory · Nota
• https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E · Nota
• https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1732309 · Nota
• https://t.me/cvenotify/17045 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-17196 · Nota de Segurança
• https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E · Nota
• https://oracle.com/security-alerts/cpujul2020.html · Nota
• https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-47w3-66wq-cpxg · Aviso do Fabricante