You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "Andrew May (Jira)" <ji...@apache.org> on 2021/04/23 17:15:00 UTC
[jira] [Comment Edited] (KAFKA-12698) CVE-2019-25013 high priority
vulnerability reported in Kafka
[ https://issues.apache.org/jira/browse/KAFKA-12698?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17330927#comment-17330927 ]
Andrew May edited comment on KAFKA-12698 at 4/23/21, 5:14 PM:
--------------------------------------------------------------
That vulnerability is a glibc one, so I'm not sure why it's being reported as a vulnerability in a Java library (unless I'm missing something - I'm not an expert).
N.B. at about the same time that this issue was created, the CVE linked above was updated to say that kafka 2.6.0 was vulnerable (& the CVE links to emails generated off the back of updates to this Jira issue)
This is now causing any dependency-checker tools that use the NIST NVD database to report Kafka 2.6.0 as vulnerable.
Could it be that what has caused this report is that a container scanner 'clair' has scanned a container made up of ['version of linux with a vulnerable version of glibc' + 'some JVM' + 'kafka 2.6.0']?
was (Author: andymay):
That vulnerability is a glibc one, so I'm not sure why it's being reported as a vulnerability in a Java library.
N.B. at about the same time that this issue was created, the CVE linked above was updated to say that kafka 2.6.0 was vulnerable (& the CVE links to emails generated off the back of updates to this Jira issue)
This is now causing any dependency-checker tools that use the NIST NVD database to report Kafka 2.6.0 as vulnerable.
Could it be that what has caused this report is that a container scanner 'clair' has scanned a container made up of ['version of linux with a vulnerable version of glibc' + 'some JVM' + 'kafka 2.6.0']?
> CVE-2019-25013 high priority vulnerability reported in Kafka
> -------------------------------------------------------------
>
> Key: KAFKA-12698
> URL: https://issues.apache.org/jira/browse/KAFKA-12698
> Project: Kafka
> Issue Type: Bug
> Reporter: priya Vijay
> Priority: Major
>
> On running clair scanner for kafka version 2.6, the following high priority vulnerability is reported for Kafka.
> CVE-2019-25013 [https://nvd.nist.gov/vuln/detail/CVE-2019-25013]
> details: The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read
--
This message was sent by Atlassian Jira
(v8.3.4#803005)