CVE-2017-12610

Name of the Vulnerable Software and Affected Versions: Apache Kafka versions 0.10.0.0 through 0.10.2.1 Apache Kafka versions 0.11.0.0 through 0.11.0.1

Description: The issue allows authenticated Kafka clients to use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.

Recommendations: For Apache Kafka versions 0.10.0.0 through 0.10.2.1, update to a version outside of this range to resolve the issue. For Apache Kafka versions 0.11.0.0 through 0.11.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the SASL/PLAIN and SASL/SCRAM authentication mechanisms until a patch is available.