oss-security - CVE-2017-12610: Authenticated Kafka clients may impersonate other users

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOJcB383nmC+pxBXoc2JcuD4TXgQrvgjCuovNavmt6sFs4+sBQ@mail.gmail.com>
Date: Thu, 26 Jul 2018 10:19:45 +0100
From: Rajini Sivaram <rsivaram@...che.org>
To: security@...ka.apache.org, oss-security@...ts.openwall.com, 
	announce@...che.org, Users <users@...ka.apache.org>, dev <dev@...ka.apache.org>, 
	kafka-clients <kafka-clients@...glegroups.com>
Subject: CVE-2017-12610: Authenticated Kafka clients may impersonate other users

CVE-2017-12610: Authenticated Kafka clients may impersonate other users

Severity: Moderate

Vendor: The Apache Software Foundation

Versions Affected:

Apache Kafka 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1

Description:

Authenticated Kafka clients may use impersonation via a manually crafted
protocol message with SASL/PLAIN or SASL/SCRAM authentication when using
the built-in PLAIN or SCRAM server implementations in Apache Kafka.

Mitigation:

Apache Kafka users should upgrade to one of the following versions where
this vulnerability has been fixed:

   - 0.10.2.2 or higher
   - 0.11.0.2 or higher
   - 1.0.0 or higher

Acknowledgements:

This issue was reported by Rajini Sivaram.

Regards,

Rajini

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.