Поиск уязвимостей
Количество 8
Количество 8
GHSA-mcwh-c9pg-xw43
Apache Kafka Deserialization of Untrusted Data vulnerability
CVE-2025-27819
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
CVE-2025-27819
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
CVE-2025-27819
In CVE-2023-25194, we announced the RCE/Denial of service attack via S ...
BDU:2025-08199
Уязвимость диспетчера сообщений Apache Kafka, связанная с недостатками механизма десериализации, позволяющая нарушителю вызвать отказ в обслуживании
ROS-20250804-02
Множественные уязвимости apache-kafka
ALT-PU-2025-14435
ALT-PU-2025-14435: package `kafka` update to version 3.9.1-alt1
ALT-PU-2025-14361
ALT-PU-2025-14361: package `kafka` update to version 3.9.1-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-mcwh-c9pg-xw43 Apache Kafka Deserialization of Untrusted Data vulnerability | CVSS3: 8.8 | 1% Низкий | больше 1 года назад |
 | CVE-2025-27819 In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0 | CVSS3: 8.8 | 1% Низкий | больше 1 года назад |
 | CVE-2025-27819 In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0 | CVSS3: 7.5 | 1% Низкий | больше 1 года назад |
| CVE-2025-27819 In CVE-2023-25194, we announced the RCE/Denial of service attack via S ... | CVSS3: 7.5 | 1% Низкий | больше 1 года назад |
 | BDU:2025-08199 Уязвимость диспетчера сообщений Apache Kafka, связанная с недостатками механизма десериализации, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 8.8 | 1% Низкий | больше 1 года назад |
 | ROS-20250804-02 Множественные уязвимости apache-kafka | CVSS3: 9.9 | больше 1 года назад | |
| ALT-PU-2025-14435 ALT-PU-2025-14435: package `kafka` update to version 3.9.1-alt1 | CVSS3: 9.9 | 12 месяцев назад | |
| ALT-PU-2025-14361 ALT-PU-2025-14361: package `kafka` update to version 3.9.1-alt1 | CVSS3: 9.9 | 12 месяцев назад |
Уязвимостей на страницу