NetSight
IP …
medium5.9

CVE-2021-38153

Observable Discrepancy in Apache Kafka

Impact

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.kafka:kafka_2.11>= 2.0.0, <= 2.4.1none recorded
mavenorg.apache.kafka:kafka_2.12>= 2.0.0, < 2.6.32.6.3
mavenorg.apache.kafka:kafka_2.13>= 2.4.0, < 2.6.32.6.3
mavenorg.apache.kafka:kafka-clients>= 2.0.0, < 2.6.32.6.3

Affected products

VendorProductAffected versions
ApacheKafka
from 2.0.0 before 2.6.3
from 2.7.0 before 2.7.2
Version 2.8.0
QuarkusQuarkus
before 2.2.4
OracleCommunications Brm - Elastic Charging Engine
before 12.0.0.4.6
Version 12.0.0.5.0
OracleCommunications Cloud Native Core Policy
Version 1.15.0
OracleFinancial Services Analytical Applications Infrastructure
from 8.0.6.0 through 8.0.9.0
from 8.1.0.0.0 through 8.1.20
OracleFinancial Services Behavior Detection Platform
from 8.0.6.0.0 through 8.0.8.0
Versions 8.1.1.0, 8.1.1.1, 8.1.2.0
OracleFinancial Services Enterprise Case Management
Versions 8.0.7.1, 8.0.7.2, 8.0.8.0, 8.0.8.1, 8.1.1.0, 8.1.1.1
OraclePrimavera Unifier
Versions 18.8, 19.12, 20.12, 21.12

Weakness classification

CWE-203

References