In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action rese

Summary

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.

Timeline

1. Jul 26, 2018, 2:00 PM UTCCVE published
2. Sep 17, 2024, 2:52 AM UTCRecord last updated

Affected versions

• Apache Software Foundation Apache Kafka

  0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0

• org.apache.kafka:kafkaMaven

  From 0.9.0.0 · fixed in 0.10.2.2

• org.apache.kafka:kafkaMaven

  From 0.11.0.0 · fixed in 0.11.0.3

• org.apache.kafka:kafkaMaven

  From 1.0.0 · fixed in 1.0.1

References 10