CVE-2021-38153CWE-203

Timing Attack Vulnerability for Apache Kafka Connect and Clients

published September 22, 2021

CVSS
—
EPSS
6%
Percentile
93.5
In the wild
Unconfirmed
What it is

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06201 · 93.5th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2021-09-22T09:05Z
EPSS history
Timeline
  • 22 SEP 09:05Z
    Timing Attack Vulnerability for Apache Kafka Connect and Clients
    cvelistv5