title: Timing Attack Vulnerability for Apache Kafka Connect and Clients
description: Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
problem types: CWE-203 Observable Discrepancy
affected:
{
product: Apache Kafka
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 2.0.1, status: affected, version: Apache Kafka 2.0.x, versionType: custom
lessThanOrEqual: 2.1.1, status: affected, version: Apache Kafka 2.1.x, versionType: custom
lessThanOrEqual: 2.2.2, status: affected, version: Apache Kafka 2.2.x, versionType: custom
lessThanOrEqual: 2.3.1, status: affected, version: Apache Kafka 2.3.x, versionType: custom
lessThanOrEqual: 2.4.1, status: affected, version: Apache Kafka 2.4.x, versionType: custom
lessThanOrEqual: 2.5.1, status: affected, version: Apache Kafka 2.5.x, versionType: custom
lessThanOrEqual: 2.6.2, status: affected, version: Apache Kafka 2.6.x, versionType: custom
lessThanOrEqual: 2.7.1, status: affected, version: Apache Kafka 2.7.x, versionType: custom
lessThanOrEqual: 2.8.0, status: affected, version: Apache Kafka 2.8.x, versionType: custom
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]