Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

An update of the kafka package has been released.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, Data Persistence (OWASP Java HTML Sanitizer)). Supported versions that are affected are     17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in takeover of Primavera Unifier. (CVE-2021-42575)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform,Data Parsing (jsoup)). Supported versions that are affected are 20.12 and 21.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2021-37714)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via     HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover     of Oracle WebLogic Server. (CVE-2021-44832)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203445	Photon OS 4.0: Kafka PHSA-2021-4.0-0130	Nessus	PhotonOS Local Security Checks	medium
156832	Oracle Primavera Unifier (Jan 2022 CPU)	Nessus	CGI abuses	critical
155310	Photon OS 3.0: Kafka PHSA-2021-3.0-0324	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2021-38153

medium

Tenable Plugins

medium

critical

medium