What is the CVSS score of CVE-2021-38153?

CVE-2021-38153 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 5.8%.

Is there a patch available for CVE-2021-38153?

Yes, a patch is available for CVE-2021-38153. Update the affected software to the latest version immediately.

Kafka CVE-2021-38153

Q: Which versions of Kafka are affected by CVE-2021-38153?

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be.. A patch is available.

MEDIUM

Observable Discrepancy (CWE-203)

2021-09-22 security@apache.org

Apache Information Disclosure Kafka Quarkus Communications Brm Elastic Charging Engine Communications Cloud Native Core Policy Financial Services Analytical Applications Infrastructure Financial Services Behavior Detection Platform Financial Services Enterprise Case Management Primavera Unifier

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 22, 2021 - 09:15 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

528 maven packages depend on org.apache.kafka:kafka-clients (165 direct, 368 indirect)
108 maven packages depend on org.apache.kafka:kafka_2.11 (30 direct, 78 indirect)
25 maven packages depend on org.apache.kafka:kafka_2.12 (19 direct, 6 indirect)
8 maven packages depend on org.apache.kafka:kafka_2.13 (8 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0 and other introduced versions.

DescriptionNVD

Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-203. Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0. Affected products include: Apache Kafka, Quarkus, Oracle Communications Brm - Elastic Charging Engine, Oracle Communications Cloud Native Core Policy, Oracle Financial Services Analytical Applications Infrastructure.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.