Non notée
CVE-2018-1288 In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may…
Description
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Kafka | 1.0.0 | Pas de correctif indiqué |
Références
- [kafka-users] 20180726 CVE-2018-1288: Authenticated Kafka clients may interfere with data replication lists.apache.org
- 104900 www.securityfocus.com
- RHSA-2018:3768 access.redhat.com
- [kafka-commits] 20190802 [kafka-site] branch asf-site updated: Add CVE-2018-17196, fix some links. (#223) lists.apache.org
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities lists.apache.org
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [flink-issues] 20200402 [GitHub] [flink] zentol opened a new pull request #11617: [FLINK-16389][kafka] Bump kafka version to 0.10.2.2 lists.apache.org
- www.oracle.com www.oracle.com
- [kafka-dev] 20211007 Re: CVE Back Port? lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Kafka
Les 23 CVE de Apache Kafka →
CVE-2026-114349
Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Non notée
CVE-2026-112375
Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
Non notée
CVE-2026-116593
Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
Non notée
CVE-2026-115644
Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
Non notée