Vulnerability · Published Sep 22, 2021 · Assigned by apache

CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and Clients

Medium 5.9

In plain English

A medium-severity security flaw in Apache Kafka from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.2% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium

Exploit odds (30 days)6.2%top 6.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apache.kafka:kafka-clients	2.6.3	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka-clients	2.8.1	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka-clients	2.7.2	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka_2.11	no fix listed	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka_2.12	2.8.1	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka_2.12	2.7.2	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka_2.12	2.6.3	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka_2.13	2.6.3	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka_2.13	2.7.2	GHSA-3j6g-hxx5-3q26
Maven	org.apache.kafka:kafka_2.13	2.8.1	GHSA-3j6g-hxx5-3q26

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Kafka	Apache Kafka 2.0.x – through 2.0.1Apache Kafka 2.1.x – through 2.1.1Apache Kafka 2.2.x – through 2.2.2Apache Kafka 2.3.x – through 2.3.1Apache Kafka 2.4.x – through 2.4.1Apache Kafka 2.5.x – through 2.5.1Apache Kafka 2.6.x – through 2.6.2Apache Kafka 2.7.x – through 2.7.1

Weakness: CWE-203

References

https://kafka.apache.org/cve-list x_refsource_MISC
[kafka-dev] 20211007 Re: CVE Back Port? mailing-list, x_refsource_MLIST
[kafka-dev] 20211012 [VOTE] 2.6.3 RC0 mailing-list, x_refsource_MLIST
[kafka-users] 20211012 [VOTE] 2.6.3 RC0 mailing-list, x_refsource_MLIST
[kafka-users] 20211012 [VOTE] 2.7.2 RC0 mailing-list, x_refsource_MLIST
[kafka-dev] 20211012 [VOTE] 2.7.2 RC0 mailing-list, x_refsource_MLIST
[kafka-users] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0 mailing-list, x_refsource_MLIST
[kafka-dev] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0 mailing-list, x_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC