CVE-2022-34917
Description
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
How to fix
- apache kafka2.8.2, 3.0.2, 3.1.2, 3.2.3 or later
- org.apache.kafka:kafka2.8.2, 3.0.2, 3.1.2, 3.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache kafka | 2.8.0 ≤ v < 2.8.2, 3.0.0 ≤ v < 3.0.2, 3.1.0 ≤ v < 3.1.2, 3.2.0 ≤ v < 3.2.3 | 2.8.2, 3.0.2, 3.1.2, 3.2.3 |
| org.apache.kafka:kafkaMaven | 2.8.0 ≤ v < 2.8.2, 3.0.0 ≤ v < 3.0.2, 3.1.0 ≤ v < 3.1.2, 3.2.0 ≤ v < 3.2.3 | 2.8.2, 3.0.2, 3.1.2, 3.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.