Timing Attack Vulnerability for Apache Kafka Connect and Clients

Summary

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Timeline

1. Sep 22, 2021, 9:05 AM UTCCVE published
2. Aug 4, 2024, 1:37 AM UTCRecord last updated

Affected versions

• Apache Software Foundation Apache Kafka

  From Apache Kafka 2.0.x · through 2.0.1; From Apache Kafka 2.1.x · through 2.1.1; From Apache Kafka 2.2.x · through 2.2.2; From Apache Kafka 2.3.x · through 2.3.1; From Apache Kafka 2.4.x · through 2.4.1; From Apache Kafka 2.5.x · through 2.5.1; From Apache Kafka 2.6.x · through 2.6.2; From Apache Kafka 2.7.x · through 2.7.1; From Apache Kafka 2.8.x · through 2.8.0

• org.apache.kafka:kafka_2.11Maven

  From 2.0.0 · through 2.4.1

• org.apache.kafka:kafka_2.12Maven

  From 2.0.0 · fixed in 2.6.3

• org.apache.kafka:kafka_2.12Maven

  From 2.7.0 · fixed in 2.7.2

• org.apache.kafka:kafka_2.12Maven

  From 2.8.0 · fixed in 2.8.1

• org.apache.kafka:kafka_2.13Maven

  From 2.4.0 · fixed in 2.6.3

• org.apache.kafka:kafka_2.13Maven

  From 2.7.0 · fixed in 2.7.2

• org.apache.kafka:kafka_2.13Maven

  From 2.8.0 · fixed in 2.8.1

• org.apache.kafka:kafka-clientsMaven

  From 2.0.0 · fixed in 2.6.3

• org.apache.kafka:kafka-clientsMaven

  From 2.7.0 · fixed in 2.7.2

• org.apache.kafka:kafka-clientsMaven

  From 2.8.0 · fixed in 2.8.1

References 11