PT-2021-7981 · Apache · Apache Kafka

Published 2019-07-10 · Updated 2025-06-05 · CVE-2021-38153

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Kafka versions 2.0.0 through 2.8.0

Description The issue in Apache Kafka is related to the disclosure of information through inconsistency, allowing a remote attacker to perform a brute force attack. Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.

Recommendations For Apache Kafka versions 2.0.0 through 2.8.0, upgrade to 2.8.1 or higher, or 3.0.0 or higher where this issue has been fixed. As a temporary workaround, consider restricting access to sensitive components that use Arrays.equals for password or key validation until a patch is available. Avoid using weak passwords or keys in the affected versions to minimize the risk of exploitation.

Fix

RCE

Side Channel Attack

Weakness Enumeration

CWE-20

CWE-203

CWE-264

Related Identifiers

BDU:2022-03778

BDU:2024-00046

BIT-KAFKA-2021-38153

CVE-2021-38153

GHSA-3J6G-HXX5-3Q26

Affected Products

Apache Kafka

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2021-38153 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38153 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3j6g-hxx5-3q26 · Vendor Advisory
• https://kafka.apache.org/cve-list · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38153 · Security Note
• https://ubuntu.com/security/CVE-2021-38153 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00046 · Security Note
• https://osv.dev/vulnerability/BIT-kafka-2021-38153 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03778 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38153 · Vendor Advisory
• https://github.com/apache/kafka · Note
• https://t.me/cvenotify/21244 · Telegram Post
• https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6@%3Cusers.kafka.apache.org%3E · Note