Vulnerability · Published Sep 20, 2022 · Assigned by apache
CVE-2022-34917Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
High 7.5
In plain English
A high-severity security flaw in Apache Kafka from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.kafka:kafka | 2.8.2 | GHSA-c9h3-c6qj-hh7q |
| Maven | org.apache.kafka:kafka | 3.0.2 | GHSA-c9h3-c6qj-hh7q |
| Maven | org.apache.kafka:kafka | 3.1.2 | GHSA-c9h3-c6qj-hh7q |
| Maven | org.apache.kafka:kafka | 3.2.3 | GHSA-c9h3-c6qj-hh7q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Kafka | Apache Kafka 2.8.0 2.8.0 Apache Kafka 2.8.1 2.8.1Apache Kafka 3.0.0 3.0.0Apache Kafka 3.0.1 3.0.1Apache Kafka 3.1.0 3.1.0Apache Kafka 3.1.1 3.1.1Apache Kafka 3.2.0 3.2.0Apache Kafka 3.2.1 3.2.1 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://kafka.apache.org/cve-list x_refsource_MISC