CVE-2022-34917
Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
En bref
- Source
- NVD
- EPSS
- EPSS 1.48 % · centile 74 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Modified
Description
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
Faiblesses (CWE)
- CWE-789 — Allocation mémoire d'une taille excessive
- CWE-770 — Allocation de ressources sans limite ni régulation
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Avis
- GHSA-c9h3-c6qj-hh7q — Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service
Références européennes
- ENISA EUVD · EUVD-2022-6777
- GCVE · GCVE-0-2022-34917
Avis du CERT-FR
- CERTFR-2025-AVI-0086 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0513 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0276 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 2.8.0 < 2.8.2cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.0.2cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.1.2cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.3
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache Kafka | affected Apache Kafka 2.8.0 2.8.0 ; affected Apache Kafka 2.8.1 2.8.1 ; affected Apache Kafka 3.0.0 3.0.0 ; affected Apache Kafka 3.0.1 3.0.1 ; affected Apache Kafka 3.1.0 3.1.0 ; affected Apache Kafka 3.1.1 3.1.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |