CVE-2021-38153
- Source
- https://cve.org/CVERecord?id=CVE-2021-38153
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38153.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-38153
- Aliases
- Downstream
- Related
- Published
- 2021-09-22T09:15:07.847Z
- Modified
- 2026-07-08T05:57:16.374882022Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Some components in Apache Kafka use
Arrays.equalsto validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0. - Database specific
{ "unresolved_ranges": [ { "source": "CPE_RANGE", "vendor_product": "oracle:communications_brm_-_elastic_charging_engine", "extracted_events": [ { "fixed": "12.0.0.4.6" } ], "cpes": [ "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "oracle:financial_services_analytical_applications_infrastructure", "extracted_events": [ { "introduced": "8.0.6.0" }, { "last_affected": "8.0.9.0" }, { "introduced": "8.1.0.0.0" }, { "last_affected": "8.1.20" } ], "cpes": [ "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "oracle:financial_services_behavior_detection_platform", "extracted_events": [ { "introduced": "8.0.6.0.0" }, { "last_affected": "8.0.8.0" } ], "cpes": [ "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "oracle:communications_brm_-_elastic_charging_engine", "extracted_events": [ { "introduced": "12.0.0.5.0" }, { "last_affected": "12.0.0.5.0" } ], "cpes": [ "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.5.0:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "oracle:communications_cloud_native_core_policy", "extracted_events": [ { "introduced": "1.15.0" }, { "last_affected": "1.15.0" } ], "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "oracle:financial_services_behavior_detection_platform", "extracted_events": [ { "introduced": "8.1.1.0" }, { "last_affected": "8.1.1.0" }, { "introduced": "8.1.1.1" }, { "last_affected": "8.1.1.1" }, { "introduced": "8.1.2.0" }, { "last_affected": "8.1.2.0" } ], "cpes": [ "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.0:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "oracle:financial_services_enterprise_case_management", "extracted_events": [ { "introduced": "8.0.7.1" }, { "last_affected": "8.0.7.1" }, { "introduced": "8.0.7.2" }, { "last_affected": "8.0.7.2" }, { "introduced": "8.0.8.0" }, { "last_affected": "8.0.8.0" }, { "introduced": "8.0.8.1" }, { "last_affected": "8.0.8.1" }, { "introduced": "8.1.1.0" }, { "last_affected": "8.1.1.0" }, { "introduced": "8.1.1.1" }, { "last_affected": "8.1.1.1" } ], "cpes": [ "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:financial_services_enterprise_case_management:8.1.1.1:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "oracle:primavera_unifier", "extracted_events": [ { "introduced": "18.8" }, { "last_affected": "18.8" }, { "introduced": "19.12" }, { "last_affected": "19.12" }, { "introduced": "20.12" }, { "last_affected": "20.12" }, { "introduced": "21.12" }, { "last_affected": "21.12" } ], "cpes": [ "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*" ] } ] }- References
-
- https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r26390c8b09ecfa356582d665b0c01f4cdcf16ac047c85f9f9f06a88c%40%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r45cc0602d5f2cbb72e48896dfadf5e5b87ed85630449598b40e8f0be%40%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rd9ef217b09fdefaf32a4e1835b59b96629542db57e1f63edb8b006e6%40%3Cusers.kafka.apache.org%3E
- https://kafka.apache.org/cve-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Affected packages
Git / github.com/apache/kafka
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/kafka
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*", "cpe:2.3:a:apache:kafka:2.8.0:-:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING" ], "extracted_events": [ { "introduced": "2.0.0" }, { "fixed": "2.6.3" }, { "introduced": "2.7.0" }, { "fixed": "2.7.2" }, { "introduced": "2.8.0-NA" }, { "last_affected": "2.8.0-NA" } ] }
Git / github.com/quarkusio/quarkus
Affected ranges
- Type
- GIT
- Repo
- https://github.com/quarkusio/quarkus
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "cpe": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*", "source": "CPE_RANGE", "extracted_events": [ { "introduced": "0" }, { "fixed": "2.2.4" } ] }