CVE-2021-38153
Medium
Description
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Apache Kafka
PublishedSep 22, 2021
First seenSep 22, 2021
Weakness typeCWE-203CWE-203
How to fix
Update
- apache kafka2.6.3, 2.7.2 or later
- quarkus quarkus2.2.4 or later
- oracle communications_brm_-_elastic_charging_engine12.0.0.4.6 or later
- org.apache.kafka:kafka_2.122.6.3, 2.7.2, 2.8.1 or later
- org.apache.kafka:kafka_2.132.6.3, 2.7.2, 2.8.1 or later
- org.apache.kafka:kafka-clients2.6.3, 2.7.2, 2.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache kafka | 2.0.0 ≤ v < 2.6.3, 2.7.0 ≤ v < 2.7.2, 2.8.0 | 2.6.3, 2.7.2 |
| quarkus quarkus | v < 2.2.4 | 2.2.4 |
| oracle communications_brm_-_elastic_charging_engine | v < 12.0.0.4.6, 12.0.0.5.0 | 12.0.0.4.6 |
| oracle communications_cloud_native_core_policy | 1.15.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.6.0 ≤ v ≤ 8.0.9.0, 8.1.0.0.0 ≤ v ≤ 8.1.20 | — |
| oracle financial_services_behavior_detection_platform | 8.0.6.0.0 ≤ v ≤ 8.0.8.0, 8.1.1.0, 8.1.1.1, 8.1.2.0 | — |
| oracle financial_services_enterprise_case_management | 8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1 | — |
| oracle primavera_unifier | 18.8, 19.12, 20.12, 21.12 | — |
| org.apache.kafka:kafka_2.11Maven | 2.0.0 ≤ v ≤ 2.4.1 | — |
| org.apache.kafka:kafka_2.12Maven | 2.0.0 ≤ v < 2.6.3, 2.7.0 ≤ v < 2.7.2, 2.8.0 ≤ v < 2.8.1 | 2.6.3, 2.7.2, 2.8.1 |
| org.apache.kafka:kafka_2.13Maven | 2.4.0 ≤ v < 2.6.3, 2.7.0 ≤ v < 2.7.2, 2.8.0 ≤ v < 2.8.1 | 2.6.3, 2.7.2, 2.8.1 |
| org.apache.kafka:kafka-clientsMaven | 2.0.0 ≤ v < 2.6.3, 2.7.0 ≤ v < 2.7.2, 2.8.0 ≤ v < 2.8.1 | 2.6.3, 2.7.2, 2.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.