NetSight
IP …
medium5.4

CVE-2018-1288

Improper Control of Generation of Code in Apache Kafka

Impact

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.kafka:kafka>= 0.9.0.0, <= 0.10.2.10.10.2.2

Affected products

VendorProductAffected versions
ApacheKafka
after 0.9.0.0 through 0.9.0.1
from 0.10.0.0 through 0.10.2.1
from 0.11.0.0 through 0.11.0.2
Version 1.0.0
RedhatJboss Middleware Text-Only Advisories
Version 1.0
OracleDatabase
Versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c
OraclePrimavera P6 Enterprise Project Portfolio Management
from 19.12.0.0 through 19.12.6.0
OracleTimesten In-Memory Database
before 18.1.2.1.0

Weakness classification

CWE-94

References