Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.9.2, 4.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information will be exposed via the requests and responses output log. The entire lists of impacted requests and responses are: • AlterConfigsRequest • AlterUserScramCredentialsRequest • ExpireDelegationTokenRequest • IncrementalAlterConfigsRequest • RenewDelegationTokenRequest • SaslAuthenticateRequest • createDelegationTokenResponse • describeDelegationTokenResponse • SaslAuthenticateResponse This issue affects Apache Kafka: from any version supported the listed API above through v3.9.1, v4.0.0. We advise the Kafka users to upgrade to v3.9.2, v4.0.1, or later to avoid this vulnerability.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- Apache Software Foundation Apache Kafka
From 0.11.0 · through 3.9.1
- org.apache.kafka:kafka-clients
From 0.11.0 · through 3.9.1
- org.apache.kafka:kafka-clientsMaven
From 0.11.0 · fixed in 3.9.2
- org.apache.kafka:kafka-clientsMaven
From 4.0.0 · fixed in 4.0.1