PT-2018-5434 · Apache · Apache Kafka

Published

2018-07-26

·

Updated

2022-05-13

·

CVE-2017-12610

CVSS v3.1

6.8

Medium

VectorAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 0.10.0.0 through 0.10.2.1 Apache Kafka versions 0.11.0.0 through 0.11.0.1
Description: The issue allows authenticated Kafka clients to use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.
Recommendations: For Apache Kafka versions 0.10.0.0 through 0.10.2.1, update to a version outside of this range to resolve the issue. For Apache Kafka versions 0.11.0.0 through 0.11.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the SASL/PLAIN and SASL/SCRAM authentication mechanisms until a patch is available.

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-12610
GHSA-XM78-4M3G-7WM7

Affected Products

Apache Kafka