{"id":"CVE-2021-38153","published":"2021-09-22T09:05:11Z","modified":"2024-08-04T01:37:15Z","title":"Timing Attack Vulnerability for Apache Kafka Connect and Clients","vendor":"Apache Software Foundation","product":"Apache Kafka","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Kafka","versions":[">= Apache Kafka 2.0.x, <= 2.0.1",">= Apache Kafka 2.1.x, <= 2.1.1",">= Apache Kafka 2.2.x, <= 2.2.2",">= Apache Kafka 2.3.x, <= 2.3.1",">= Apache Kafka 2.4.x, <= 2.4.1",">= Apache Kafka 2.5.x, <= 2.5.1",">= Apache Kafka 2.6.x, <= 2.6.2",">= Apache Kafka 2.7.x, <= 2.7.1",">= Apache Kafka 2.8.x, <= 2.8.0"]}],"description":{"text":"Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.06201,"percentile":0.93497,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-04-11","exploitedFirstSeen":"2023-04-11","ransomware":false,"evidence":[{"url":"https://blog.cloudflare.com/ddos-threat-report-2023-q1/","date":"2023-04-11"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"Oracle Critical Patch Update Advisory - April 2022","url":"https://otx.alienvault.com/pulse/626040216e00cd388b1b9180","created":"2022-04-20"},{"name":"ACTUALIZACION | lanzamiento de Red Hat AMQ Streams 2.0.0 y actualización de seguridad | REDHAT","url":"https://otx.alienvault.com/pulse/61e08c6c3bc170cf83060753","created":"2022-01-13"},{"name":"ACTUALIZACION | lanzamiento de Red Hat AMQ Streams 2.0.0 y actualización de seguridad | REDHAT","url":"https://otx.alienvault.com/pulse/61e08c4bdb19d679585909f5","created":"2022-01-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-203","name":"Observable Discrepancy"}],"references":[{"url":"https://kafka.apache.org/cve-list","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.kafka:kafka_2.11","vulnerableRanges":[">=2.0.0, <=2.4.1"],"patched":[],"from":["GHSA-3j6g-hxx5-3q26"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.kafka:kafka_2.12","vulnerableRanges":[">=2.0.0, <2.6.3",">=2.7.0, <2.7.2",">=2.8.0, <2.8.1"],"patched":["2.6.3","2.7.2","2.8.1"],"from":["GHSA-3j6g-hxx5-3q26"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.kafka:kafka_2.13","vulnerableRanges":[">=2.4.0, <2.6.3",">=2.7.0, <2.7.2",">=2.8.0, <2.8.1"],"patched":["2.6.3","2.7.2","2.8.1"],"from":["GHSA-3j6g-hxx5-3q26"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.kafka:kafka-clients","vulnerableRanges":[">=2.0.0, <2.6.3",">=2.7.0, <2.7.2",">=2.8.0, <2.8.1"],"patched":["2.6.3","2.7.2","2.8.1"],"from":["GHSA-3j6g-hxx5-3q26"],"provenance":"source"}],"advisories":[{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka_2.11","vulnerableRanges":[">=2.0.0, <=2.4.1"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka_2.12","vulnerableRanges":[">=2.0.0, <2.6.3"],"patched":["2.6.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka_2.12","vulnerableRanges":[">=2.7.0, <2.7.2"],"patched":["2.7.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka_2.12","vulnerableRanges":[">=2.8.0, <2.8.1"],"patched":["2.8.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka_2.13","vulnerableRanges":[">=2.4.0, <2.6.3"],"patched":["2.6.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka_2.13","vulnerableRanges":[">=2.7.0, <2.7.2"],"patched":["2.7.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka_2.13","vulnerableRanges":[">=2.8.0, <2.8.1"],"patched":["2.8.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka-clients","vulnerableRanges":[">=2.0.0, <2.6.3"],"patched":["2.6.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka-clients","vulnerableRanges":[">=2.7.0, <2.7.2"],"patched":["2.7.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3j6g-hxx5-3q26","url":"https://github.com/advisories/GHSA-3j6g-hxx5-3q26","severity":"MODERATE","ecosystem":"Maven","package":"org.apache.kafka:kafka-clients","vulnerableRanges":[">=2.8.0, <2.8.1"],"patched":["2.8.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-1963","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1963","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-09-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-38153","provenance":"source"},{"date":"2023-04-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.cloudflare.com/ddos-threat-report-2023-q1/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":55.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1297 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.7,"detail":"percentile 0.9350"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}