CVE:CVE-2021-38153
CNNVD:CNNVD-202109-1476
Apache Kafka是美国阿帕奇（Apache）基金会的一套开源的分布式流媒体平台。该平台能够获取实时数据，用于构建对数据流的变化进行实时反应的应用程序。
Apache Kafka 存在安全漏洞，该漏洞源于 Apache Kafka 中的某些组件使用Arrays.equals来验证密码或密钥，容易受到定时攻击。本地用户可以滥用Arrays.equals来暴力破解访问凭据并提升系统权限。
solution:Upgrade apache kafka to a higher version than 2.6.3,2.7.2,2.8.0,and avoid the version [2.0.0,2.6.3),[2.7.0,2.7.2),2.8.0; Upgrade quarkus quarkus to a higher version than 2.2.4,and avoid the version (,2.2.4); Upgrade oracle communications_brm_-_elastic_charging_engine to a higher version than 12.0.0.4.6,12.0.0.5.0,and avoid the version (,12.0.0.4.6),12.0.0.5.0; Upgrade oracle communications_cloud_native_core_policy to a higher version than 1.15.0,and avoid the version 1.15.0; Upgrade oracle financial_services_analytical_applications_infrastructure to a higher version than 8.0.9.0,8.1.20,and avoid the version [8.0.6.0,8.0.9.0],[8.1.0.0.0,8.1.20]; Upgrade oracle financial_services_behavior_detection_platform to a higher version than 8.0.8.0,8.1.1.0,8.1.1.1,8.1.2.0,and avoid the version [8.0.6.0.0,8.0.8.0],8.1.1.0,8.1.1.1,8.1.2.0; Upgrade oracle financial_services_enterprise_case_management to a higher version than 8.0.7.1,8.0.7.2,8.0.8.0,8.0.8.1,8.1.1.0,8.1.1.1,and avoid the version 8.0.7.1,8.0.7.2,8.0.8.0,8.0.8.1,8.1.1.0,8.1.1.1; Upgrade oracle primavera_unifier to a higher version than 18.8,19.12,20.12,21.12,and avoid the version 18.8,19.12,20.12,21.12