Security Bulletin: Vulnerability in IBM Event Streams through Apache Kafka key/password validation (CVE-2021-38153)

Summary

Vulnerability in IBM Event Streams through Apache Kafka key/password validation

Vulnerability Details

CVEID:CVE-2021-38153
**DESCRIPTION:**Apache Kafka could allow a remote attacker to obtain sensitive information, caused by a timing attack flaw due to the use of “Arrays.equals” to validate a password or key. By utilizing brute-force attack techniques, an attacker could exploit this vulnerability to obtain credentials information, and use this information to launch further attacks against the affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/209762 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

IBM Event Streams in IBM Cloud Pak for Integration

| 10.0.0

IBM Event Streams in IBM Cloud Pak for Integration

| 10.1.0

IBM Event Streams in IBM Cloud Pak for Integration

| 10.2.0

IBM Event Streams in IBM Cloud Pak for Integration

| 10.3.0

IBM Event Streams in IBM Cloud Pak for Integration

| 10.3.1

IBM Event Streams in IBM Cloud Pak for Integration

| 10.4.0

Remediation/Fixes

Upgrade to IBM Event Streams 10.5.0 by following the upgrading and migrating documentation.

Workarounds and Mitigations

None