CVE-2021-38153

apache kafka, quarkus, oracle communications brm - elastic charging engine +5 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-38153

Katalog CVE

CVSS 5.9 · Medium EPSS 6,2%

Kerentanan Observable Discrepancy pada apache kafka, quarkus +6 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

Rincian

Terbit di NVD
22 September 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-203: Observable Discrepancy
EPSS (30 hari)
6,2% peluang dieksploitasi; lebih tinggi dari 93,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apache kafka Versi 2.0.0 hingga sebelum 2.6.3
apache kafka Versi 2.7.0 hingga sebelum 2.7.2
apache kafka Versi 2.8.0
quarkus quarkus Semua versi sebelum 2.2.4
oracle communications brm - elastic charging engine Semua versi sebelum 12.0.0.4.6
oracle communications brm - elastic charging engine Versi 12.0.0.5.0
oracle communications cloud native core policy Versi 1.15.0
oracle financial services analytical applications infrastructure Versi 8.0.6.0 hingga 8.0.9.0
oracle financial services analytical applications infrastructure Versi 8.1.0.0.0 hingga 8.1.20
oracle financial services behavior detection platform Versi 8.0.6.0.0 hingga 8.0.8.0
oracle financial services behavior detection platform Versi 8.1.1.0
oracle financial services behavior detection platform Versi 8.1.1.1
oracle financial services behavior detection platform Versi 8.1.2.0
oracle financial services enterprise case management Versi 8.0.7.1
oracle financial services enterprise case management Versi 8.0.7.2
oracle financial services enterprise case management Versi 8.0.8.0
oracle financial services enterprise case management Versi 8.0.8.1
oracle financial services enterprise case management Versi 8.1.1.0
oracle financial services enterprise case management Versi 8.1.1.1
oracle primavera unifier Versi 18.8
oracle primavera unifier Versi 19.12
oracle primavera unifier Versi 20.12
oracle primavera unifier Versi 21.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.