rhsa-2025:2416
Vulnerability from csaf_redhat
Published
2025-03-05 20:59
Modified
2025-04-03 08:33
Summary
Red Hat Security Advisory: Streams for Apache Kafka 2.9.0 release and security update

Notes

Topic
Streams for Apache Kafka 2.9.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 2.9.0 serves as a replacement for Red Hat Streams for Apache Kafka 2.8.0, and includes security and bug fixes, and enhancements. Security Fix(es): * Cruise Control:cio.netty:netty-common:4.1.115.Final-redhat [amq-st-2] "(CVE-2023-52428)" * Cruise Control:com.nimbusds:nimbus-jose-jwt:9.37.2.redhat [amq-st-2] "(CVE-2024-47535)" * Cruise Control:org.apache.kafka:kafka-clients:3.5.2.redhat+ [amq-st-2] "(CVE-2024-31141)" * Cruise Control:io:commons-io:2.15.1.redhat+ [amq-st-2] "(CVE-2024-47554)" * Cruise Control:org.eclipse.jetty:jetty-server:9.4.56.v20240826-redhat+ [amq-st-2] "(CVE-2024-8184)" * Cruise Control:org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks [amq-st-2] "(CVE-2024-8184)" * Kafka Exporter:golang-github-danielqsj-kafka_exporter: Golang FIPS zeroed buffer [amq-st-2] "(CVE-2024-9355)" * Kafka Exporter:golang-github-danielqsj-kafka_exporter: net/http: Denial of service due to improper 100-continue handling in net/http [amq-st-2] "(CVE-2024-24791)"
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Streams for Apache Kafka 2.9.0 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed\nbackbone that allows microservices and other applications to share data with\nextremely high throughput and extremely low latency.\n\nThis release of Red Hat Streams for Apache Kafka 2.9.0 serves as a replacement for Red Hat Streams for Apache Kafka 2.8.0, and includes security and bug fixes, and enhancements.\n\nSecurity Fix(es):\n* Cruise Control:cio.netty:netty-common:4.1.115.Final-redhat [amq-st-2] \"(CVE-2023-52428)\"\n\n* Cruise Control:com.nimbusds:nimbus-jose-jwt:9.37.2.redhat [amq-st-2] \"(CVE-2024-47535)\"\n\n* Cruise Control:org.apache.kafka:kafka-clients:3.5.2.redhat+ [amq-st-2] \"(CVE-2024-31141)\"\n\n* Cruise Control:io:commons-io:2.15.1.redhat+ [amq-st-2] \"(CVE-2024-47554)\"\n\n* Cruise Control:org.eclipse.jetty:jetty-server:9.4.56.v20240826-redhat+ [amq-st-2] \"(CVE-2024-8184)\"\n\n* Cruise Control:org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks [amq-st-2] \"(CVE-2024-8184)\"\n\n* Kafka Exporter:golang-github-danielqsj-kafka_exporter: Golang FIPS zeroed buffer [amq-st-2] \"(CVE-2024-9355)\"\n\n* Kafka Exporter:golang-github-danielqsj-kafka_exporter: net/http: Denial of service due to improper 100-continue handling in net/http [amq-st-2] \"(CVE-2024-24791)\"",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2025:2416",
            url: "https://access.redhat.com/errata/RHSA-2025:2416",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2295310",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2295310",
         },
         {
            category: "external",
            summary: "2309764",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2309764",
         },
         {
            category: "external",
            summary: "2315719",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2315719",
         },
         {
            category: "external",
            summary: "2316271",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2316271",
         },
         {
            category: "external",
            summary: "2318564",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2318564",
         },
         {
            category: "external",
            summary: "2325538",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2325538",
         },
         {
            category: "external",
            summary: "2327264",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2327264",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2416.json",
         },
      ],
      title: "Red Hat Security Advisory: Streams for Apache Kafka 2.9.0 release and security update",
      tracking: {
         current_release_date: "2025-04-03T08:33:45+00:00",
         generator: {
            date: "2025-04-03T08:33:45+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2025:2416",
         initial_release_date: "2025-03-05T20:59:06+00:00",
         revision_history: [
            {
               date: "2025-03-05T20:59:06+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2025-03-05T20:59:06+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-03T08:33:45+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Streams for Apache Kafka 2.9.0",
                        product: {
                           name: "Streams for Apache Kafka 2.9.0",
                           product_id: "Streams for Apache Kafka 2.9.0",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:amq_streams:2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Streams for Apache Kafka",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2023-52428",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2024-09-04T17:02:58.468000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2309764",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in the Nimbus Jose JWT package. This issue could allow an attacker to use a malicious large JWE p2c header value for PasswordBasedDecrypter and cause a Denial of Service (DoS).",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "nimbus-jose-jwt: large JWE p2c header value causes Denial of Service",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Streams for Apache Kafka 2.9.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2023-52428",
            },
            {
               category: "external",
               summary: "RHBZ#2309764",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2309764",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2023-52428",
               url: "https://www.cve.org/CVERecord?id=CVE-2023-52428",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2023-52428",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2023-52428",
            },
         ],
         release_date: "2024-02-11T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-05T20:59:06+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2416",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "nimbus-jose-jwt: large JWE p2c header value causes Denial of Service",
      },
      {
         cve: "CVE-2024-8184",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2024-10-14T16:01:01.239238+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2318564",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Jetty's ThreadLimitHandler.getRemote(). This flaw allows unauthorized users to cause remote denial of service (DoS) attacks. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This vulnerability is rated as moderate rather than important because it requires specific conditions to be met, including continuous, crafted requests that deliberately target memory allocation to exhaust resources. While it can cause a denial of service, it does not lead to direct compromise of sensitive data, unauthorized access, or code execution.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Streams for Apache Kafka 2.9.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-8184",
            },
            {
               category: "external",
               summary: "RHBZ#2318564",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2318564",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-8184",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-8184",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-8184",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-8184",
            },
            {
               category: "external",
               summary: "https://github.com/jetty/jetty.project/pull/11723",
               url: "https://github.com/jetty/jetty.project/pull/11723",
            },
            {
               category: "external",
               summary: "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq",
               url: "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq",
            },
            {
               category: "external",
               summary: "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30",
               url: "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30",
            },
         ],
         release_date: "2024-10-14T15:09:37.861000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-05T20:59:06+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2416",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks",
      },
      {
         acknowledgments: [
            {
               names: [
                  "David Benoit",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2024-9355",
         cwe: {
            id: "CWE-457",
            name: "Use of Uninitialized Variable",
         },
         discovery_date: "2024-09-30T17:51:17.811000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2315719",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "golang-fips: Golang FIPS zeroed buffer",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Streams for Apache Kafka 2.9.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-9355",
            },
            {
               category: "external",
               summary: "RHBZ#2315719",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2315719",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-9355",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-9355",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
            },
         ],
         release_date: "2024-09-30T20:53:42.833000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-05T20:59:06+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2416",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "LOW",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  version: "3.1",
               },
               products: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "golang-fips: Golang FIPS zeroed buffer",
      },
      {
         cve: "CVE-2024-24791",
         cwe: {
            id: "CWE-20",
            name: "Improper Input Validation",
         },
         discovery_date: "2024-07-02T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2295310",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "net/http: Denial of service due to improper 100-continue handling in net/http",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "An attacker would need to control a malicious server and induce a client to connect to it, requiring some amount of preparation outside of the attacker's control. This reduces the severity score of this flaw to Moderate.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Streams for Apache Kafka 2.9.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-24791",
            },
            {
               category: "external",
               summary: "RHBZ#2295310",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2295310",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-24791",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-24791",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-24791",
            },
            {
               category: "external",
               summary: "https://go.dev/cl/591255",
               url: "https://go.dev/cl/591255",
            },
            {
               category: "external",
               summary: "https://go.dev/issue/67555",
               url: "https://go.dev/issue/67555",
            },
            {
               category: "external",
               summary: "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
               url: "https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ",
            },
         ],
         release_date: "2024-07-02T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-05T20:59:06+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2416",
            },
            {
               category: "workaround",
               details: "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "net/http: Denial of service due to improper 100-continue handling in net/http",
      },
      {
         cve: "CVE-2024-31141",
         cwe: {
            id: "CWE-552",
            name: "Files or Directories Accessible to External Parties",
         },
         discovery_date: "2024-11-19T09:00:35.857468+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2327264",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations, which include the ability to read from disk or environment variables. In applications where an untrusted party can specify Apache Kafka Clients configurations, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Streams for Apache Kafka 2.9.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-31141",
            },
            {
               category: "external",
               summary: "RHBZ#2327264",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2327264",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-31141",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-31141",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-31141",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-31141",
            },
            {
               category: "external",
               summary: "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv",
               url: "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv",
            },
         ],
         release_date: "2024-11-19T08:40:50.695000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-05T20:59:06+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2416",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider",
      },
      {
         cve: "CVE-2024-47535",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2024-11-12T16:01:18.772613+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2325538",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in Netty. An unsafe reading of the environment file could potentially cause a denial of service. When loaded on a Windows application, Netty attempts to load a file that does not exist. If an attacker creates a large file, the Netty application crashes.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "netty: Denial of Service attack on windows app using Netty",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Streams for Apache Kafka 2.9.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-47535",
            },
            {
               category: "external",
               summary: "RHBZ#2325538",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2325538",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-47535",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-47535",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-47535",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-47535",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3",
               url: "https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3",
            },
            {
               category: "external",
               summary: "https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv",
               url: "https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv",
            },
         ],
         release_date: "2024-11-12T15:50:08.334000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-05T20:59:06+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2416",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "netty: Denial of Service attack on windows app using Netty",
      },
      {
         cve: "CVE-2024-47554",
         cwe: {
            id: "CWE-400",
            name: "Uncontrolled Resource Consumption",
         },
         discovery_date: "2024-10-03T12:00:40.921058+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2316271",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability was found in the Apache Commons IO component in the org.apache.commons.io.input.XmlStreamReader class. Excessive CPU resource consumption can lead to a denial of service when an untrusted input is processed.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Streams for Apache Kafka 2.9.0",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-47554",
            },
            {
               category: "external",
               summary: "RHBZ#2316271",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2316271",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-47554",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-47554",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-47554",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-47554",
            },
            {
               category: "external",
               summary: "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1",
               url: "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1",
            },
         ],
         release_date: "2024-10-03T11:32:48.936000+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-05T20:59:06+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "Streams for Apache Kafka 2.9.0",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:2416",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "Streams for Apache Kafka 2.9.0",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.