ghsa-xm78-4m3g-7wm7
Vulnerability from github
Published
2022-05-13 01:25
Modified
2022-07-01 21:23
Severity ?
Summary
Improper Authentication in Apache Kafka
Details
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.
{ affected: [ { database_specific: { last_known_affected_version_range: "<= 0.10.2.1", }, package: { ecosystem: "Maven", name: "org.apache.kafka:kafka-clients", }, ranges: [ { events: [ { introduced: "0.10.0.0", }, { fixed: "0.10.2.2", }, ], type: "ECOSYSTEM", }, ], }, { database_specific: { last_known_affected_version_range: "<= 0.11.0.1", }, package: { ecosystem: "Maven", name: "org.apache.kafka:kafka-clients", }, ranges: [ { events: [ { introduced: "0.11.0.0", }, { fixed: "0.11.0.2", }, ], type: "ECOSYSTEM", }, ], }, ], aliases: [ "CVE-2017-12610", ], database_specific: { cwe_ids: [ "CWE-287", ], github_reviewed: true, github_reviewed_at: "2022-07-01T21:23:20Z", nvd_published_at: "2018-07-26T14:29:00Z", severity: "MODERATE", }, details: "In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.", id: "GHSA-xm78-4m3g-7wm7", modified: "2022-07-01T21:23:20Z", published: "2022-05-13T01:25:19Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2017-12610", }, { type: "WEB", url: "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/b6157be1a09df332294213bd21e90dcf9fe4c1810193be54620e4210@%3Cusers.kafka.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E", }, { type: "WEB", url: "https://www.oracle.com/security-alerts/cpujul2020.html", }, { type: "WEB", url: "http://www.securityfocus.com/bid/104899", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", type: "CVSS_V3", }, ], summary: "Improper Authentication in Apache Kafka", }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.