CVE-2018-1288

CVE-2018-1288 affects Apache Kafka across multiple 0.9.x–1.0.0 release lines; authenticated users can issue a fetch request that performs a broker-reserved action, potentially causing data loss during replication. Public documentation here documents the issue and confirms fixes in later Kafka bui...

CVE-2018-1288

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss...

CVE-2017-12610

In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka...

Apache Kafka readObject vulnerability analysis report-vulnerability warning-the black bar safety net

I. background description Apache Kafka is an open source Apache stream processing platform, from the Apache to write, the use of scala and java. The project aims to provide a unified, high-throughput, low-latency real-time data processing platform. II. Vulnerability overview Kafka the internal...

Apache Kafka Deserialization Vulnerability

Apache Kafka is an application service for building real-time data pipelines and streaming media. Apache kafka connect-api is vulnerable to a deserialization vulnerability in the execution of the FileOffsetBackingStore class. An attacker can exploit the vulnerability to cause remote code executio...

Apache Kafka desrialization vulnerability

Apache kafka connect-api runtime contains a desrialization vul via FileOffsetBackingStore which leads to remote code execution, this can be exploited reliably in JDK1.7.005, below is a unit test for it: import junit.framework.Test; import junit.framework.TestCase; import junit.framework.TestSuite...