cnvd - cnvd-2022-14712

cnvd-2022-14712

Vulnerability from cnvd

Title: Apache Kafka定时攻击漏洞

Description:

Apache Kafka是美国阿帕奇（Apache）软件基金会开发的一套开源分布式流媒体平台。该平台能够获取实时数据，用于构建对数据流的变化进行实时反应的应用程序。

Apache Kafka部分版本中存在定时攻击漏洞。该漏洞主要由于Kafka使用了Arrays.equals组件来进行密钥或密码验证，攻击者可使用该漏洞对使用此类凭证验证身份的用户进行暴力破解，从而获取访问凭据并提升系统权限。

Severity: 高

Patch Name: Apache Kafka定时攻击漏洞的补丁

Patch Description:

Apache Kafka部分版本中存在定时攻击漏洞。该漏洞主要由于Kafka使用了Arrays.equals组件来进行密钥或密码验证，攻击者可使用该漏洞对使用此类凭证验证身份的用户进行暴力破解，从而获取访问凭据并提升系统权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://kafka.apache.org/cve-list

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-38153

Impacted products

Name
['Apache Kafka 2.8.0', 'Apache Kafka >=2.0.0，<2.6.3', 'Apache Kafka >=2.7.0，<2.7.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-38153",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153"
    }
  },
  "description": "Apache Kafka\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u5f00\u53d1\u7684\u4e00\u5957\u5f00\u6e90\u5206\u5e03\u5f0f\u6d41\u5a92\u4f53\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u80fd\u591f\u83b7\u53d6\u5b9e\u65f6\u6570\u636e\uff0c\u7528\u4e8e\u6784\u5efa\u5bf9\u6570\u636e\u6d41\u7684\u53d8\u5316\u8fdb\u884c\u5b9e\u65f6\u53cd\u5e94\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\n\nApache Kafka\u90e8\u5206\u7248\u672c\u4e2d\u5b58\u5728\u5b9a\u65f6\u653b\u51fb\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u4e3b\u8981\u7531\u4e8eKafka\u4f7f\u7528\u4e86Arrays.equals\u7ec4\u4ef6\u6765\u8fdb\u884c\u5bc6\u94a5\u6216\u5bc6\u7801\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u4f7f\u7528\u8be5\u6f0f\u6d1e\u5bf9\u4f7f\u7528\u6b64\u7c7b\u51ed\u8bc1\u9a8c\u8bc1\u8eab\u4efd\u7684\u7528\u6237\u8fdb\u884c\u66b4\u529b\u7834\u89e3\uff0c\u4ece\u800c\u83b7\u53d6\u8bbf\u95ee\u51ed\u636e\u5e76\u63d0\u5347\u7cfb\u7edf\u6743\u9650\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://kafka.apache.org/cve-list",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-14712",
  "openTime": "2022-02-23",
  "patchDescription": "Apache Kafka\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u5f00\u53d1\u7684\u4e00\u5957\u5f00\u6e90\u5206\u5e03\u5f0f\u6d41\u5a92\u4f53\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u80fd\u591f\u83b7\u53d6\u5b9e\u65f6\u6570\u636e\uff0c\u7528\u4e8e\u6784\u5efa\u5bf9\u6570\u636e\u6d41\u7684\u53d8\u5316\u8fdb\u884c\u5b9e\u65f6\u53cd\u5e94\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nApache Kafka\u90e8\u5206\u7248\u672c\u4e2d\u5b58\u5728\u5b9a\u65f6\u653b\u51fb\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u4e3b\u8981\u7531\u4e8eKafka\u4f7f\u7528\u4e86Arrays.equals\u7ec4\u4ef6\u6765\u8fdb\u884c\u5bc6\u94a5\u6216\u5bc6\u7801\u9a8c\u8bc1\uff0c\u653b\u51fb\u8005\u53ef\u4f7f\u7528\u8be5\u6f0f\u6d1e\u5bf9\u4f7f\u7528\u6b64\u7c7b\u51ed\u8bc1\u9a8c\u8bc1\u8eab\u4efd\u7684\u7528\u6237\u8fdb\u884c\u66b4\u529b\u7834\u89e3\uff0c\u4ece\u800c\u83b7\u53d6\u8bbf\u95ee\u51ed\u636e\u5e76\u63d0\u5347\u7cfb\u7edf\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Kafka\u5b9a\u65f6\u653b\u51fb\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Kafka 2.8.0",
      "Apache Kafka \u003e=2.0.0\uff0c\u003c2.6.3",
      "Apache Kafka \u003e=2.7.0\uff0c\u003c2.7.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153",
  "serverity": "\u9ad8",
  "submitTime": "2021-09-22",
  "title": "Apache Kafka\u5b9a\u65f6\u653b\u51fb\u6f0f\u6d1e"
}

CVE-2021-38153 (GCVE-0-2021-38153)

Vulnerability from cvelistv5

Published

2021-09-22 09:05

Modified

2024-08-04 01:37

Severity ?

CWE

CWE-203 - Observable Discrepancy

Summary

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

References

▼	URL	Tags
	https://kafka.apache.org/cve-list	x_refsource_MISC
	https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Kafka	Version: Apache Kafka 2.0.x < Version: Apache Kafka 2.1.x < Version: Apache Kafka 2.2.x < Version: Apache Kafka 2.3.x < Version: Apache Kafka 2.4.x < Version: Apache Kafka 2.5.x < Version: Apache Kafka 2.6.x < Version: Apache Kafka 2.7.x < Version: Apache Kafka 2.8.x <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:37:15.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kafka.apache.org/cve-list"
          },
          {
            "name": "[kafka-dev] 20211007 Re: CVE Back Port?",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20211012 [VOTE] 2.6.3 RC0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-users] 20211012 [VOTE] 2.6.3 RC0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-users] 20211012 [VOTE] 2.7.2 RC0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20211012 [VOTE] 2.7.2 RC0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-users] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Kafka",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.0.1",
              "status": "affected",
              "version": "Apache Kafka 2.0.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.1.1",
              "status": "affected",
              "version": "Apache Kafka 2.1.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.2.2",
              "status": "affected",
              "version": "Apache Kafka 2.2.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "Apache Kafka 2.3.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.4.1",
              "status": "affected",
              "version": "Apache Kafka 2.4.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.5.1",
              "status": "affected",
              "version": "Apache Kafka 2.5.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.6.2",
              "status": "affected",
              "version": "Apache Kafka 2.6.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.7.1",
              "status": "affected",
              "version": "Apache Kafka 2.7.x",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.8.0",
              "status": "affected",
              "version": "Apache Kafka 2.8.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Apache Kafka would like to thank J. Santilli for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-203",
              "description": "CWE-203 Observable Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:31:36",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kafka.apache.org/cve-list"
        },
        {
          "name": "[kafka-dev] 20211007 Re: CVE Back Port?",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-dev] 20211012 [VOTE] 2.6.3 RC0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-users] 20211012 [VOTE] 2.6.3 RC0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-users] 20211012 [VOTE] 2.7.2 RC0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-dev] 20211012 [VOTE] 2.7.2 RC0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-users] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E"
        },
        {
          "name": "[kafka-dev] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Timing Attack Vulnerability for Apache Kafka Connect and Clients",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-38153",
          "STATE": "PUBLIC",
          "TITLE": "Timing Attack Vulnerability for Apache Kafka Connect and Clients"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Kafka",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.0.x",
                            "version_value": "2.0.1"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.1.x",
                            "version_value": "2.1.1"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.2.x",
                            "version_value": "2.2.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.3.x",
                            "version_value": "2.3.1"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.4.x",
                            "version_value": "2.4.1"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.5.x",
                            "version_value": "2.5.1"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.6.x",
                            "version_value": "2.6.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.7.x",
                            "version_value": "2.7.1"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kafka 2.8.x",
                            "version_value": "2.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Apache Kafka would like to thank J. Santilli for reporting this issue."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "moderate"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-203 Observable Discrepancy"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kafka.apache.org/cve-list",
              "refsource": "MISC",
              "url": "https://kafka.apache.org/cve-list"
            },
            {
              "name": "[kafka-dev] 20211007 Re: CVE Back Port?",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-dev] 20211012 [VOTE] 2.6.3 RC0",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-users] 20211012 [VOTE] 2.6.3 RC0",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be@%3Cusers.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-users] 20211012 [VOTE] 2.7.2 RC0",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6@%3Cusers.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-dev] 20211012 [VOTE] 2.7.2 RC0",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-users] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c@%3Cusers.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-dev] 20211026 Re: [kafka-clients] [VOTE] 2.7.2 RC0",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-38153",
    "datePublished": "2021-09-22T09:05:11",
    "dateReserved": "2021-08-06T00:00:00",
    "dateUpdated": "2024-08-04T01:37:15.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted