Incorrect Authorization Affecting org.apache.kafka:kafka package, versions [3.5.0, 3.6.2)


0.0
medium
0
10

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.04% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHEKAFKA-6600922
  • published 12 Apr 2024
  • disclosed 12 Apr 2024
  • credit Unknown

How to fix?

Upgrade org.apache.kafka:kafka to version 3.6.2 or higher.

Overview

Affected versions of this package are vulnerable to Incorrect Authorization during the migration process from ZooKeeper mode to KRaft mode.

Notes:

Two preconditions are needed to trigger the bug:

  1. The administrator decides to remove an ACL

  2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.

The full impact depends on the ACLs in use:

  1. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact.

  2. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.