Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
21 Sep 2021
13 Aug 2021
Jonathan Santilli of Snyk Security Team
How to fix?
org.apache.kafka:kafka-clients to version 2.8.1, 2.7.2 or higher.
org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.
Affected versions of this package are vulnerable to Timing Attack. Some components in Apache Kafka use
Arrays.equals to validate a password or key, which is vulnerable to brute force attacks by malicious users.