PT-2018-5434
CVE-2017-12610
·
تاريخ النشر
2018-07-26
·
تاريخ التحديث
2022-05-13
الوصف من
CVSS 3.1
6.8
متوسطةالمقاييسAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions:
Apache Kafka versions 0.10.0.0 through 0.10.2.1
Apache Kafka versions 0.11.0.0 through 0.11.0.1
Description:
The issue allows authenticated Kafka clients to use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.
Recommendations:
For Apache Kafka versions 0.10.0.0 through 0.10.2.1, update to a version outside of this range to resolve the issue.
For Apache Kafka versions 0.11.0.0 through 0.11.0.1, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to the SASL/PLAIN and SASL/SCRAM authentication mechanisms until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾