Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.01432.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Apache Software Foundation Apache Kafka affected
Version Status Constraints
Apache Kafka 2.0.x affected ≤ 2.0.1
Apache Kafka 2.1.x affected ≤ 2.1.1
Apache Kafka 2.2.x affected ≤ 2.2.2
Apache Kafka 2.3.x affected ≤ 2.3.1
Apache Kafka 2.4.x affected ≤ 2.4.1
Apache Kafka 2.5.x affected ≤ 2.5.1
Apache Kafka 2.6.x affected ≤ 2.6.2
Apache Kafka 2.7.x affected ≤ 2.7.1
Apache Kafka 2.8.x affected ≤ 2.8.0

Configuration 1 [-]

OR cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:kafka:2.8.0:-:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat AMQ Streams 1.6.6
kafka cpe:/a:redhat:amq_streams:1 RHSA-2022:0219 2022-01-20T00:00:00Z
kafka-clients cpe:/a:redhat:amq_streams:1 RHSA-2022:0219 2022-01-20T00:00:00Z
Red Hat AMQ Streams 2.0.0
kafka cpe:/a:redhat:amq_streams:2 RHSA-2022:0138 2022-01-13T00:00:00Z
Red Hat build of Quarkus 2.2.5
kafka-clients cpe:/a:redhat:openshift_application_runtimes:1.0 RHSA-2022:0589 2022-02-21T00:00:00Z
Red Hat Data Grid 8.3.1
kafka-clients cpe:/a:redhat:jboss_data_grid:8 RHSA-2022:2232 2022-05-12T00:00:00Z
Red Hat Fuse 7.11
kafka-clients cpe:/a:redhat:jboss_fuse:7 RHSA-2022:5532 2022-07-07T00:00:00Z
RHAF Camel-K 1.8
kafka-clients cpe:/a:redhat:integration:1 RHSA-2022:6407 2022-09-09T00:00:00Z
RHINT Camel-Q 2.7
kafka-clients cpe:/a:redhat:camel_quarkus:2.7 RHSA-2022:5606 2022-07-19T00:00:00Z
RHINT Service Registry 2.0.3 GA
kafka-clients cpe:/a:redhat:service_registry:2.0.3 RHSA-2022:0501 2022-02-09T00:00:00Z
Vert.x 4.2.5
kafka cpe:/a:redhat:openshift_application_runtimes:1.0 RHSA-2022:0737 2022-03-31T00:00:00Z
kafka-clients cpe:/a:redhat:openshift_application_runtimes:1.0 RHSA-2022:0737 2022-03-31T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Apache Subscribe
Kafka Subscribe
Oracle Subscribe
Communications Brm - Elastic Charging Engine Subscribe
Communications Cloud Native Core Policy Subscribe
Financial Services Analytical Applications Infrastructure Subscribe
Financial Services Behavior Detection Platform Subscribe
Financial Services Enterprise Case Management Subscribe
Primavera Unifier Subscribe
Quarkus Subscribe
Quarkus Subscribe
Redhat Subscribe
Amq Streams Subscribe
Camel Quarkus Subscribe
Integration Subscribe
Jboss Data Grid Subscribe
Jboss Fuse Subscribe
Openshift Application Runtimes Subscribe
Service Registry Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2021-1963 Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Github GHSA Github GHSA GHSA-3j6g-hxx5-3q26 Observable Discrepancy in Apache Kafka
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://kafka.apache.org/cve-list cve-icon cve-icon
https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2021-38153 cve-icon
https://www.cve.org/CVERecord?id=CVE-2021-38153 cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2022.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2024-08-04T01:37:15.929Z

Reserved: 2021-08-06T00:00:00

Link: CVE-2021-38153

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-09-22T09:15:07.847

Modified: 2024-11-21T06:16:30.110

Link: CVE-2021-38153

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-09-21T00:00:00Z

Links: CVE-2021-38153 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses