io.strimzi:strimzi 0.51.0-RC1

Direct Vulnerabilities

Known vulnerabilities in the io.strimzi:strimzi package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Unintended Proxy or Intermediary ('Confused Deputy') Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via the `Kafka.spec.entityOperator` process. An attacker can gain unauthorized access to read and modify secrets in other namespaces by crafting a custom resource with the `watchedNamespace` field set to a target namespace and minting a token for the ServiceAccount in the attacker's namespace. This allows access to any namespace for which the Cluster Operator has been granted permissions through RoleBindings. How to fix Unintended Proxy or Intermediary ('Confused Deputy')? Upgrade `io.strimzi:strimzi` to version 1.0.1 or higher.	[,1.0.1)
M Least Privilege Violation Affected versions of this package are vulnerable to Least Privilege Violation in the process responsible for assigning RBAC rights to the Entity Operator ServiceAccount. An attacker can gain unauthorized access to sensitive custom resources and secrets by exploiting excessive permissions granted when only one operator is deployed. How to fix Least Privilege Violation? Upgrade `io.strimzi:strimzi` to version 1.0.1 or higher.	[,1.0.1)
M Missing Authentication for Critical Function Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to incorrect access control in the Kafka Connect REST API. An attacker can deny service, mirror topics' content to an unauthorized Kafka cluster, and potentially steal Kafka SASL credentials by querying the MirrorMaker Kafka REST API. How to fix Missing Authentication for Critical Function? Upgrade `io.strimzi:strimzi` to version 1.0.1 or higher.	[,1.0.1)

Vulnerability

Vulnerable Version

Unintended Proxy or Intermediary ('Confused Deputy')

Affected versions of this package are vulnerable to Unintended Proxy or Intermediary ('Confused Deputy') via the Kafka.spec.entityOperator process. An attacker can gain unauthorized access to read and modify secrets in other namespaces by crafting a custom resource with the watchedNamespace field set to a target namespace and minting a token for the ServiceAccount in the attacker's namespace. This allows access to any namespace for which the Cluster Operator has been granted permissions through RoleBindings.

How to fix Unintended Proxy or Intermediary ('Confused Deputy')?

Upgrade io.strimzi:strimzi to version 1.0.1 or higher.

[,1.0.1)

Least Privilege Violation

Affected versions of this package are vulnerable to Least Privilege Violation in the process responsible for assigning RBAC rights to the Entity Operator ServiceAccount. An attacker can gain unauthorized access to sensitive custom resources and secrets by exploiting excessive permissions granted when only one operator is deployed.

How to fix Least Privilege Violation?

Upgrade io.strimzi:strimzi to version 1.0.1 or higher.

[,1.0.1)

Missing Authentication for Critical Function

Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to incorrect access control in the Kafka Connect REST API. An attacker can deny service, mirror topics' content to an unauthorized Kafka cluster, and potentially steal Kafka SASL credentials by querying the MirrorMaker Kafka REST API.

How to fix Missing Authentication for Critical Function?

Upgrade io.strimzi:strimzi to version 1.0.1 or higher.

[,1.0.1)

io.strimzi:strimzi@0.51.0-RC1

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically