Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-38153

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Published

2021-09-22T09:15:07.847

Last Modified

2024-11-21T06:16:30.110

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-203
  • Type: Primary
    CWE-203
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache kafka < 2.6.3 Yes
Application apache kafka < 2.7.2 Yes
Application apache kafka 2.8.0 Yes
Application quarkus quarkus < 2.2.4 Yes
Application oracle communications_brm_-_elastic_charging_engine < 12.0.0.4.6 Yes
Application oracle communications_brm_-_elastic_charging_engine 12.0.0.5.0 Yes
Application oracle communications_cloud_native_core_policy 1.15.0 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.0.9.0 Yes
Application oracle financial_services_analytical_applications_infrastructure ≤ 8.1.20 Yes
Application oracle financial_services_behavior_detection_platform ≤ 8.0.8.0 Yes
Application oracle financial_services_behavior_detection_platform 8.1.1.0 Yes
Application oracle financial_services_behavior_detection_platform 8.1.1.1 Yes
Application oracle financial_services_behavior_detection_platform 8.1.2.0 Yes
Application oracle financial_services_enterprise_case_management 8.0.7.1 Yes
Application oracle financial_services_enterprise_case_management 8.0.7.2 Yes
Application oracle financial_services_enterprise_case_management 8.0.8.0 Yes
Application oracle financial_services_enterprise_case_management 8.0.8.1 Yes
Application oracle financial_services_enterprise_case_management 8.1.1.0 Yes
Application oracle financial_services_enterprise_case_management 8.1.1.1 Yes
Application oracle primavera_unifier 18.8 Yes
Application oracle primavera_unifier 19.12 Yes
Application oracle primavera_unifier 20.12 Yes
Application oracle primavera_unifier 21.12 Yes
References