Confluent Kafka
Monthly
Improper TLS certificate validation in the Confluent Kafka Python client's HashiCorp Vault KMS integration (confluent-kafka versions 0 through 2.14.2) allows a man-in-the-middle attacker to obtain sensitive information when the integration is used with its default configuration, which disables certificate verification. Successful exploitation requires the application to use the Vault KMS integration and the attacker to achieve a MITM position on the TLS connection to Vault, making this a conditional but significant risk (CVSS 7.4). No public exploit has been identified at the time of analysis.
Improper TLS certificate validation in the Confluent Kafka Python client's HashiCorp Vault KMS integration (confluent-kafka versions 0 through 2.14.2) allows a man-in-the-middle attacker to obtain sensitive information when the integration is used with its default configuration, which disables certificate verification. Successful exploitation requires the application to use the Vault KMS integration and the attacker to achieve a MITM position on the TLS connection to Vault, making this a conditional but significant risk (CVSS 7.4). No public exploit has been identified at the time of analysis.