<!--#include virtual="includes/_header.htm" -->
<body class="page-cve-list ">
<!--#include virtual="includes/_top.htm" -->
<div class="content">
	<!--#include virtual="includes/_nav.htm" -->
	<div class="right">

<h1>Apache Kafka Security Vulnerabilities</h1>

This page lists all security vulnerabilities fixed in released versions of Apache Kafka.

<h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12399">CVE-2019-12399</a>
Apache Kafka Connect REST API may expose plaintext secrets in tasks endpoint</h2>

<p>When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are
configured with one or more config providers, and a connector is created/updated on 
that Connect cluster to use an externalized secret variable in a substring of a 
connector configuration property value (the externalized secret variable is not the
whole configuration property value), then any client can issue a request to 
the same Connect cluster to obtain the connector's task configurations and 
the response will contain the plaintext secret rather than the externalized secrets variable.
Users should upgrade to 2.0.2 or higher, 2.1.2 or higher, 2.2.2 or higher, or 2.3.1 or higher
where this vulnerability has been fixed.</p>

<table class="data-table">
<tbody>
  <tr>
    <td>Versions affected</td>
    <td>2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0</td>
  </tr>
  <tr>
    <td>Fixed versions</td>
    <td>2.0.2, 2.1.2, 2.2.2, 2.3.1 and later</td>
  </tr>
  <tr>
    <td>Impact</td>
    <td>This issue could result in exposing externalized connector secrets.</td>
  </tr>
  <tr>
    <td>Issue announced</td>
    <td>13 Jan 2020</td>
  </tr>
</tbody>
</table>

<h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17196">CVE-2018-17196</a>
Authenticated clients with Write permission may bypass transaction/idempotent ACL validation</h2>
<p>In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually
craft a Produce request which bypasses transaction/idempotent ACL validation.
Only authenticated clients with Write permission on the respective topics are
able to exploit this vulnerability. Users should upgrade to 2.1.1 or later
where this vulnerability has been fixed.</p>

<table class="data-table">
<tbody>
  <tr>
    <td>Versions affected</td>
    <td>0.11.0.0 to 2.1.0</td>
  </tr>
  <tr>
    <td>Fixed versions</td>
    <td>2.1.1 and later</td>
  </tr>
  <tr>
    <td>Impact</td>
    <td>This issue could result in privilege escalation.</td>
  </tr>
  <tr>
    <td>Issue announced</td>
    <td>10 July 2019</td>
  </tr>
</tbody>
</table>

<h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1288">CVE-2018-1288</a>
Authenticated Kafka clients may interfere with data replication</h2>

<p>Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request
interfering with data replication, resulting in data loss.</p>

<table class="data-table">
<tbody>
  <tr>
    <td>Versions affected</td>
    <td>0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, 1.0.0</td>
  </tr>
  <tr>
    <td>Fixed versions</td>
    <td>0.10.2.2, 0.11.0.3, 1.0.1, 1.1.0</td>
  </tr>
  <tr>
    <td>Impact</td>
    <td>This issue could potentially lead to data loss.</td>
  </tr>
  <tr>
    <td>Issue announced</td>
    <td>26 July 2018</td>
  </tr>
</tbody>
</table>


<h2><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12610">CVE-2017-12610</a>
Authenticated Kafka clients may impersonate other users</h2>

<p>Authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM
authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.</p>

<table class="data-table">
<tbody>
  <tr>
    <td>Versions affected</td>
    <td>0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.1</td>
  </tr>
  <tr>
    <td>Fixed versions</td>
    <td>0.10.2.2, 0.11.0.2, 1.0.0</td>
  </tr>
  <tr>
    <td>Impact</td>
    <td>This issue could result in privilege escalation.</td>
  </tr>
  <tr>
    <td>Issue announced</td>
    <td>26 July 2018</td>
  </tr>
</tbody>
</table>


<!--#include virtual="includes/_footer.htm" -->