Apache Software Foundation Kafka 2.8.0
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:kafka:2.8.0:-:*:*:*:*:*:*
part: a version: 2.8.0 update: -
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Kafka (82021aa1-8d95-5395-9710-ae9ce7a194c2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/kafka |
purl2cpe | 2026-06-01 10:14:28.735693 |
pkg:github/apache/kafka |
purl2cpe | 2026-06-01 10:14:28.735694 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-38153 |
vulnerable | 2026-06-08 05:32:55.550650 |
Timing Attack Vulnerability for Apache Kafka Connect and Clients
Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Published: 2021-09-22T09:05:11.000Z
Updated: 2024-08-04T01:37:15.929Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.