{"id":"CVE-2018-1288","aliases":["EUVD-2022-3959","GHSA-gh27-38p5-mrxc","SUSE-SU-2018:2536-1","SUSE-SU-2018:3563-1","openSUSE-SU-2024:10886-1"],"status":"published","title":"Improper Control of Generation of Code in Apache Kafka","description":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04801,"percentile":0.92008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2018-07-26T14:00:00Z","modified":"2026-10-24T10:30:28Z","fixes":[{"ecosystem":"Maven","package":"org.apache.kafka:kafka","fixed_in":["0.10.2.2","0.11.0.3","1.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-monasca","fixed_in":["8.0+git.1535031421.9262a47-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-spark","fixed_in":["8.0+git.1534267176.a5f3a22-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"kafka","fixed_in":["0.10.2.2-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-monasca-api","fixed_in":["2.2.1~dev24-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-monasca","fixed_in":["8.0+git.1535031421.9262a47-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-spark","fixed_in":["8.0+git.1534267176.a5f3a22-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"kafka","fixed_in":["0.10.2.2-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-monasca-api","fixed_in":["2.2.1~dev24-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"kafka","fixed_in":["0.10.2.2-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-monasca-api","fixed_in":["2.2.1~dev24-3.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.kafka:kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0.0"},{"last_affected":"0.10.2.1"},{"fixed":"0.10.2.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.kafka:kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0.0"},{"last_affected":"0.11.0.2"},{"fixed":"0.11.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.kafka:kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.kafka:kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0.0"},{"fixed":"0.10.2.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.kafka:kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0.0"},{"fixed":"0.11.0.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.kafka:kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}],"versions":["1.0.0"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2.2-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"logstash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"monasca-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180608_12.47-9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1535031421.9262a47-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1534267176.a5f3a22-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2.2-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-monasca-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1~dev24-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1535031421.9262a47-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1534267176.a5f3a22-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2.2-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-monasca-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1~dev24-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"kafka","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2.2-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-monasca-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1~dev24-3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kafka-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3.6"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"kafka"},{"vendor":"apache software foundation","product":"apache kafka"},{"vendor":"oracle","product":"database"},{"vendor":"oracle","product":"primavera_p6_enterprise_project_portfolio_management"},{"vendor":"oracle","product":"timesten_in-memory_database"},{"vendor":"redhat","product":"jboss_middleware_text-only_advisories"}],"references":[{"url":"https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef%40%3Cusers.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/104900","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/d1581fb6464c9bec8a72575c01f5097d68e2fbb230aff24622622a58%40%3Ccommits.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r07e1bbd1643847d599feb34c707906a4fdcc81e3a6ab01a10c451d40%40%3Cissues.flink.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1288","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef@%3Cusers.kafka.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/d1581fb6464c9bec8a72575c01f5097d68e2fbb230aff24622622a58@%3Ccommits.kafka.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r07e1bbd1643847d599feb34c707906a4fdcc81e3a6ab01a10c451d40@%3Cissues.flink.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c@%3Cdev.kafka.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gh27-38p5-mrxc"},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182536-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1086909","tags":["report"]},{"url":"https://bugzilla.suse.com/1090192","tags":["report"]},{"url":"https://bugzilla.suse.com/1090343","tags":["report"]},{"url":"https://bugzilla.suse.com/1090849","tags":["report"]},{"url":"https://bugzilla.suse.com/1094448","tags":["report"]},{"url":"https://bugzilla.suse.com/1095603","tags":["report"]},{"url":"https://bugzilla.suse.com/1096985","tags":["report"]},{"url":"https://bugzilla.suse.com/1102920","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3817","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183563-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1094851","tags":["report"]},{"url":"https://bugzilla.suse.com/1094971","tags":["report"]},{"url":"https://bugzilla.suse.com/1102662","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7489","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1288","description":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","status":"published","published":"2018-07-26T14:00:00Z","modified":"2024-09-17T02:52:05.951Z","updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2022-3959","description":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","status":"published","published":"2018-07-26T14:00:00Z","modified":"2024-09-17T02:52:05Z","updated_at":"2026-11-03T00:28:36.981601Z"}],"ghsa":[{"id":"GHSA-gh27-38p5-mrxc","title":"Improper Control of Generation of Code in Apache Kafka","description":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","status":"published","published":"2022-05-13T01:02:18Z","modified":"2023-01-27T05:02:29Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:18.427692Z"}],"nvd":[{"id":"CVE-2018-1288","description":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","status":"published","published":"2018-07-26T14:29:00.547Z","modified":"2026-06-17T01:50:55.723Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:35.310988Z"}],"osv":[{"id":"CVE-2018-1288","description":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","status":"published","published":"2018-07-26T14:29:00.547Z","modified":"2026-10-24T10:30:28.419953605Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"GHSA-gh27-38p5-mrxc","title":"Improper Control of Generation of Code in Apache Kafka","description":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.","status":"published","published":"2022-05-13T01:02:18Z","modified":"2023-11-08T03:59:51.574264Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"openSUSE-SU-2024:10886-1","title":"kafka-source-2.1.0-3.6 on GA media","description":"These are all security issues fixed in the kafka-source-2.1.0-3.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:33.186142Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:2536-1","title":"Security update for grafana, kafka, logstash and monasca-installer","description":"This update for grafana, kafka, logstash and monasca-installer fixes the following issues:\n\nThe following security issues have been fixed:\n\ngrafana:\n\n- CVE-2018-12099: Fix Cross-Site-Scripting (XSS) vulnerabilities in dashboard links. (bsc#1096985)\n\nkafka:\n\n- CVE-2018-1288: Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch\n  request interfering with data replication, resulting in data loss. (bsc#1102920)\n\nlogstash:\n\n- CVE-2018-3817: Fix potential leak of sensitive data when logging warnings about deprecated options. (bsc#1090849)\n\nAdditionally, the following non-security issues have been fixed:\n\nmonasca-installer:\n\n- Add complete set of elasticsearch performance tunables.\n- Update to version Build_20180427_14.04 (bsc#1090192, bsc#1090343)\n- Fix bad elasticsearch-curator configuration. (bsc#1090192)\n- Enable bootstrap.memory_lock for Elasticsearch. (bsc#1090343)\n\nlogstash:\n\n- Declare Gemfile as config to prevent loss of installed plugins when updating.\n- Stop installing prebuilt jruby for non-x86.\n\nkafka: \n\n- Update to version 0.10.2.2 (bsc#1102920, CVE-2018-1288)\n- Add noreplace directive for /etc/kafka/server.properties.\n- Reduce package ownership of tmpfiles.d to bare minium. (SLE12 SP2) \n- Set log rotation options. (bsc#1094448)\n- Disable jmxremote debugging. (bsc#1095603)\n- Increase open file limits. (bsc#1086909)\n","status":"published","published":"2018-08-28T09:05:28Z","modified":"2026-02-04T03:02:59.047298Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3563-1","title":"Security update for ardana-monasca, ardana-spark, kafka, kafka-kit, openstack-monasca-api","description":"This update for ardana-monasca, ardana-spark, kafka, kafka-kit, openstack-monasca-api fixes the following issues:\n\nThis update for ardana-monasca to version 8.0+git.1535031421.9262a47 fixes these issues:\n\n- Requests Apache to reload on change (bsc#1102662)\n- Avoids managing non-Monasca users (bsc#1102662)\n- Line up perms on storm.conf to match rpm (bsc#1094971)\n\nThis update for ardana-spark to version 8.0+git.1532114050.04654a8 fixes this issue:\n\n- Only set log dir perms on legacy install (bsc#1094851)\n\nThis update for kafka to version 0.10.2.2 fixes this security issue:\n\n- CVE-2018-1288: Authenticated Kafka users may have performed action reserved\n  for the Broker via a manually created fetch request interfering with data\n  replication, resulting in data loss (bsc#1102920).\n\nThis update for kafka to version 0.10.2.2 fixes these non-security issues:\n\n- set internal.leave.group.on.close to false in KafkaStreams\n- Improve message for Kafka failed startup with non-Kafka data in data.dirs\n- add max_number _of_retries to exponential backoff strategy\n- Mute logger for reflections.org at the warn level in system tests\n- Kafka connect: error with special characters in connector name\n- streams task gets stuck after re-balance due to LockException\n- CachingSessionStore doesn't use the default keySerde.\n- RocksDBSessionStore doesn't use default aggSerde.\n- Recommended values for Connect transformations contain the wrong class name\n- Kafka broker fails to start if a topic containing dot in its name is marked for delete but hasn't been deleted during previous uptime\n- GlobalKTable does not checkpoint offsets after restoring state\n- Log cleaning can increase message size and cause cleaner to crash with buffer overflow\n- Some socket connections not closed after restart of Kafka Streams\n- Distributed Herder Deadlocks on Shutdown\n- Log cleaner fails due to large offset in segment file\n- StreamsKafkaClient should not use StreamsConfig.POLL_MS_CONFIG\n- Refactor kafkatest docker support\n- ducktape kafka service: do not assume Service contains num_nodes\n- Using _DUCKTAPE_OPTIONS has no effect on executing tests\n- Connect WorkerSinkTask out of order offset commit can lead to inconsistent state\n- RocksDB segments not removed when store is closed causes re-initialization to fail\n- FetchMetadata creates unneeded Strings on instantiation\n- SourceTask#stop() not called after exception raised in poll()\n- Sink connectors that explicitly 'resume' topic partitions can resume a paused task\n- GlobalStateManagerImpl should not write offsets of in-memory stores in checkpoint file\n- Source KTable checkpoint is not correct\n- ConnectSchema#equals() broken for array-typed default values\n\nThis update for openstack-monasca-api to version 2.2.1~dev24 fixes these issues:\n\n- devstack: download storm from archive.apache.org\n- Backport tempest test robustness improvements\n- 1724543-fixed kafka partition creation error in devstack installation\n- Fix:No alarms created if metric name in alarm def. expr. is mix case\n- Zuul: Remove project name\n- Run against Pike requirements\n","status":"published","published":"2018-10-30T06:10:54Z","modified":"2026-02-04T02:14:10.765538Z","updated_at":"2026-11-02T15:53:45.378228Z"}]}}