CVE-2018-1288
Fixed in a distro release EPSS 5%
In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
Products: Apache Software Foundation Apache Kafka
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.kafka:kafka | 0.10.2.2 |
| Maven | org.apache.kafka:kafka | 0.11.0.3 |
| Maven | org.apache.kafka:kafka | 1.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE HPE Helion OpenStack 8 | ardana-monasca | 8.0+git.1535031421.9262a47-3.12.1 |
| SUSE HPE Helion OpenStack 8 | ardana-spark | 8.0+git.1534267176.a5f3a22-3.6.1 |
| SUSE HPE Helion OpenStack 8 | kafka | 0.10.2.2-5.6.1 |
| SUSE HPE Helion OpenStack 8 | openstack-monasca-api | 2.2.1~dev24-3.6.1 |
| SUSE OpenStack Cloud 7 | grafana | 4.5.1-1.8.1 |
| SUSE OpenStack Cloud 7 | kafka | 0.10.2.2-5.1 |
| SUSE OpenStack Cloud 7 | logstash | 2.4.1-5.1 |
| SUSE OpenStack Cloud 7 | monasca-installer | 20180608_12.47-9.1 |
| SUSE OpenStack Cloud 8 | ardana-monasca | 8.0+git.1535031421.9262a47-3.12.1 |
| SUSE OpenStack Cloud 8 | ardana-spark | 8.0+git.1534267176.a5f3a22-3.6.1 |
| SUSE OpenStack Cloud 8 | kafka | 0.10.2.2-5.6.1 |
| SUSE OpenStack Cloud 8 | openstack-monasca-api | 2.2.1~dev24-3.6.1 |
| SUSE OpenStack Cloud Crowbar 8 | kafka | 0.10.2.2-5.6.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-monasca-api | 2.2.1~dev24-3.6.1 |
| openSUSE Tumbleweed | kafka-source | 2.1.0-3.6 |