CVE-2018-1288
Medium
Description
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Apache Kafka
PublishedJul 26, 2018
First seenJul 26, 2018
How to fix
Update
- oracle timesten_in-memory_database18.1.2.1.0 or later
- org.apache.kafka:kafka0.10.2.2, 0.11.0.3, 1.0.1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache kafka | 0.9.0.0 < v ≤ 0.9.0.1, 0.10.0.0 ≤ v ≤ 0.10.2.1, 0.11.0.0 ≤ v ≤ 0.11.0.2, 1.0.0 | — |
| redhat jboss_middleware_text-only_advisories | 1.0 | — |
| oracle database | 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c | — |
| oracle primavera_p6_enterprise_project_portfolio_management | 19.12.0.0 ≤ v ≤ 19.12.6.0 | — |
| oracle timesten_in-memory_database | v < 18.1.2.1.0 | 18.1.2.1.0 |
| org.apache.kafka:kafkaMaven | 0.9.0.0 ≤ v < 0.10.2.2, 0.11.0.0 ≤ v < 0.11.0.3, 1.0.0 ≤ v < 1.0.1 | 0.10.2.2, 0.11.0.3, 1.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.