Incorrect Authorization Affecting org.apache.kafka:kafka package, versions [3.5.0, 3.6.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEKAFKA-6600922
- published 12 Apr 2024
- disclosed 12 Apr 2024
- credit Unknown
Introduced: 12 Apr 2024
CVE-2024-27309 Open this link in a new tabHow to fix?
Upgrade org.apache.kafka:kafka to version 3.6.2 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Authorization during the migration process from ZooKeeper mode to KRaft mode.
Notes:
Two preconditions are needed to trigger the bug:
The administrator decides to remove an ACL
The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.
The full impact depends on the ACLs in use:
If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact.
if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.