Not rated
CVE-2017-12610 In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a…
Description
In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Kafka | Versions not published |
References
- [kafka-users] 20180726 CVE-2017-12610: Authenticated Kafka clients may impersonate other users lists.apache.org
- 104899 www.securityfocus.com
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities lists.apache.org
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified
Other CVEs of Apache Kafka
The 23 CVEs of Apache Kafka →
CVE-2026-114349
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Not rated
CVE-2026-112375
Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
Not rated
CVE-2026-116593
Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
Not rated
CVE-2026-115644
Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
Not rated