Поиск уязвимостей
Количество 8
Количество 8
CVE-2025-27818
A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0). When configuring the broker via config file or AlterConfig command, or connector via the Kafka Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.LdapLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the K...
CVE-2025-27818
A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0). When configuring the broker via config file or AlterConfig command, or connector via the Kafka Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.LdapLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafk
CVE-2025-27818
A possible security vulnerability has been identified in Apache Kafka. ...
GHSA-76qp-h5mr-frr4
Apache Kafka Deserialization of Untrusted Data vulnerability
BDU:2025-08198
Уязвимость диспетчера сообщений Apache Kafka, связанная с недостатками механизма десериализации, позволяющая нарушителю выполнить удаленный код
ROS-20250804-02
Множественные уязвимости apache-kafka
ALT-PU-2025-14435
ALT-PU-2025-14435: package `kafka` update to version 3.9.1-alt1
ALT-PU-2025-14361
ALT-PU-2025-14361: package `kafka` update to version 3.9.1-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-27818 A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0). When configuring the broker via config file or AlterConfig command, or connector via the Kafka Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.LdapLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the K... | CVSS3: 8 | 1% Низкий | больше 1 года назад |
 | CVE-2025-27818 A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0). When configuring the broker via config file or AlterConfig command, or connector via the Kafka Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.LdapLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafk | CVSS3: 8.8 | 1% Низкий | больше 1 года назад |
| CVE-2025-27818 A possible security vulnerability has been identified in Apache Kafka. ... | CVSS3: 8.8 | 1% Низкий | больше 1 года назад |
| GHSA-76qp-h5mr-frr4 Apache Kafka Deserialization of Untrusted Data vulnerability | CVSS3: 8.8 | 1% Низкий | больше 1 года назад |
 | BDU:2025-08198 Уязвимость диспетчера сообщений Apache Kafka, связанная с недостатками механизма десериализации, позволяющая нарушителю выполнить удаленный код | CVSS3: 9.9 | 1% Низкий | больше 1 года назад |
 | ROS-20250804-02 Множественные уязвимости apache-kafka | CVSS3: 9.9 | больше 1 года назад | |
| ALT-PU-2025-14435 ALT-PU-2025-14435: package `kafka` update to version 3.9.1-alt1 | CVSS3: 9.9 | 12 месяцев назад | |
| ALT-PU-2025-14361 ALT-PU-2025-14361: package `kafka` update to version 3.9.1-alt1 | CVSS3: 9.9 | 12 месяцев назад |
Уязвимостей на страницу