WID-SEC-W-2025-1269
Vulnerability from csaf_certbund - Published: 2025-06-09 22:00 - Updated: 2026-01-06 23:00Summary
Apache Kafka: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Apache Kafka ist eine verteilte Streaming-Plattform mit einer Publish-Subcribe-Architektur (Pub-Sub).
Angriff
Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial-of-Service auszulösen.
Betroffene Betriebssysteme
- Linux
- UNIX
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Apache Kafka ist eine verteilte Streaming-Plattform mit einer Publish-Subcribe-Architektur (Pub-Sub).",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Apache Kafka ausnutzen, um Informationen offenzulegen, beliebigen Programmcode auszuf\u00fchren oder einen Denial-of-Service auszul\u00f6sen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-1269 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1269.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-1269 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1269"
},
{
"category": "external",
"summary": "Mailing List OSS Security vom 2025-06-09",
"url": "https://seclists.org/oss-sec/2025/q2/235"
},
{
"category": "external",
"summary": "Mailing List OSS Security vom 2025-06-09",
"url": "https://seclists.org/oss-sec/2025/q2/236"
},
{
"category": "external",
"summary": "Mailing List OSS Security vom 2025-06-09",
"url": "https://seclists.org/oss-sec/2025/q2/237"
},
{
"category": "external",
"summary": "PoC CVE-2025-27817 vom 2025-06-11",
"url": "https://github.com/kk12-30/CVE-2025-27817"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:9922 vom 2025-06-30",
"url": "https://access.redhat.com/errata/RHSA-2025:9922"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7241535 vom 2025-08-06",
"url": "https://www.ibm.com/support/pages/node/7241535"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7241547 vom 2025-08-06",
"url": "https://www.ibm.com/support/pages/node/7241547"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7241589 vom 2025-08-06",
"url": "https://www.ibm.com/support/pages/node/7241589"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7242900 vom 2025-08-22",
"url": "https://www.ibm.com/support/pages/node/7242900"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7243781 vom 2025-09-02",
"url": "https://www.ibm.com/support/pages/node/7243781"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7244112 vom 2025-09-05",
"url": "https://www.ibm.com/support/pages/node/7244112"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7246161 vom 2025-09-29",
"url": "https://www.ibm.com/support/pages/node/7246161"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7249358 vom 2025-10-28",
"url": "https://www.ibm.com/support/pages/node/7249358"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7250266 vom 2025-11-06",
"url": "https://www.ibm.com/support/pages/node/7250266"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:23417 vom 2025-12-17",
"url": "https://access.redhat.com/errata/RHSA-2025:23417"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7256423 vom 2026-01-07",
"url": "https://www.ibm.com/support/pages/node/7256423"
}
],
"source_lang": "en-US",
"title": "Apache Kafka: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-01-06T23:00:00.000+00:00",
"generator": {
"date": "2026-01-07T09:25:28.376+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2025-1269",
"initial_release_date": "2025-06-09T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-06-09T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-06-10T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: 2371365, 2371367"
},
{
"date": "2025-06-11T22:00:00.000+00:00",
"number": "3",
"summary": "PoC f\u00fcr CVE-2025-27817 aufgenommen"
},
{
"date": "2025-06-30T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-08-06T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2025-08-24T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von IBM und IBM-APAR aufgenommen"
},
{
"date": "2025-09-02T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2025-09-04T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2025-09-29T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2025-10-27T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2025-11-05T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2025-12-16T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-01-06T23:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von IBM aufgenommen"
}
],
"status": "final",
"version": "13"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c4.0.0",
"product": {
"name": "Apache Kafka \u003c4.0.0",
"product_id": "T044458"
}
},
{
"category": "product_version",
"name": "4.0.0",
"product": {
"name": "Apache Kafka 4.0.0",
"product_id": "T044458-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:apache:kafka:4.0.0"
}
}
},
{
"category": "product_version_range",
"name": "\u003c3.9.1",
"product": {
"name": "Apache Kafka \u003c3.9.1",
"product_id": "T044459"
}
},
{
"category": "product_version",
"name": "3.9.1",
"product": {
"name": "Apache Kafka 3.9.1",
"product_id": "T044459-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:apache:kafka:3.9.1"
}
}
}
],
"category": "product_name",
"name": "Kafka"
}
],
"category": "vendor",
"name": "Apache"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c12.14.0",
"product": {
"name": "IBM App Connect Enterprise \u003c12.14.0",
"product_id": "T045927"
}
},
{
"category": "product_version",
"name": "12.14.0",
"product": {
"name": "IBM App Connect Enterprise 12.14.0",
"product_id": "T045927-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:app_connect_enterprise:12.14.0"
}
}
},
{
"category": "product_version_range",
"name": "\u003cLTS 12.0.14",
"product": {
"name": "IBM App Connect Enterprise \u003cLTS 12.0.14",
"product_id": "T045928"
}
},
{
"category": "product_version",
"name": "LTS 12.0.14",
"product": {
"name": "IBM App Connect Enterprise LTS 12.0.14",
"product_id": "T045928-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:app_connect_enterprise:lts_12.0.14"
}
}
},
{
"category": "product_version",
"name": "13.0.1.0-13.0.4.0",
"product": {
"name": "IBM App Connect Enterprise 13.0.1.0-13.0.4.0",
"product_id": "T046467",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.4.0"
}
}
},
{
"category": "product_version",
"name": "12.0.1.0-12.0.12.15",
"product": {
"name": "IBM App Connect Enterprise 12.0.1.0-12.0.12.15",
"product_id": "T046468",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.15"
}
}
}
],
"category": "product_name",
"name": "App Connect Enterprise"
},
{
"category": "product_name",
"name": "IBM Business Automation Workflow",
"product": {
"name": "IBM Business Automation Workflow",
"product_id": "T019704",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:business_automation_workflow:-"
}
}
},
{
"category": "product_name",
"name": "IBM InfoSphere Data Replication",
"product": {
"name": "IBM InfoSphere Data Replication",
"product_id": "T021399",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:infosphere_data_replication:-"
}
}
},
{
"category": "product_name",
"name": "IBM InfoSphere Information Server",
"product": {
"name": "IBM InfoSphere Information Server",
"product_id": "T035705",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:infosphere_information_server:-"
}
}
},
{
"branches": [
{
"category": "product_version",
"name": "for z/OS 10.1.0.0-10.1.0.5",
"product": {
"name": "IBM Integration Bus for z/OS 10.1.0.0-10.1.0.5",
"product_id": "T046469",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:integration_bus:10.1.0.0_-_10.1.0.5::for_zos"
}
}
}
],
"category": "product_name",
"name": "Integration Bus"
},
{
"branches": [
{
"category": "product_version",
"name": "7.6.1",
"product": {
"name": "IBM Maximo Asset Management 7.6.1",
"product_id": "389168",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:maximo_asset_management:7.6.1"
}
}
}
],
"category": "product_name",
"name": "Maximo Asset Management"
},
{
"category": "product_name",
"name": "IBM Operational Decision Manager",
"product": {
"name": "IBM Operational Decision Manager",
"product_id": "T005180",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:operational_decision_manager:-"
}
}
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c7.5.0 UP13",
"product": {
"name": "IBM QRadar SIEM \u003c7.5.0 UP13",
"product_id": "T045828"
}
},
{
"category": "product_version",
"name": "7.5.0 UP13",
"product": {
"name": "IBM QRadar SIEM 7.5.0 UP13",
"product_id": "T045828-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up13"
}
}
}
],
"category": "product_name",
"name": "QRadar SIEM"
},
{
"branches": [
{
"category": "product_version",
"name": "11.5",
"product": {
"name": "IBM Security Guardium 11.5",
"product_id": "1411051",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:security_guardium:11.5"
}
}
}
],
"category": "product_name",
"name": "Security Guardium"
},
{
"branches": [
{
"category": "product_version_range",
"name": "IP Edition \u003c4.2 Fix Pack 23",
"product": {
"name": "IBM Tivoli Network Manager IP Edition \u003c4.2 Fix Pack 23",
"product_id": "T046654"
}
},
{
"category": "product_version",
"name": "IP Edition 4.2 Fix Pack 23",
"product": {
"name": "IBM Tivoli Network Manager IP Edition 4.2 Fix Pack 23",
"product_id": "T046654-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition___4.2_fix_pack_23"
}
}
}
],
"category": "product_name",
"name": "Tivoli Network Manager"
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-27817",
"product_status": {
"known_affected": [
"67646",
"T035705",
"T045828",
"T045927",
"389168",
"T045928",
"T046468",
"T044458",
"T021399",
"T046469",
"T044459",
"T019704",
"T005180",
"T046467",
"T046654",
"1411051"
]
},
"release_date": "2025-06-09T22:00:00.000+00:00",
"title": "CVE-2025-27817"
},
{
"cve": "CVE-2025-27818",
"product_status": {
"known_affected": [
"67646",
"T035705",
"T045828",
"T045927",
"389168",
"T045928",
"T046468",
"T044458",
"T021399",
"T046469",
"T044459",
"T019704",
"T005180",
"T046467",
"T046654",
"1411051"
]
},
"release_date": "2025-06-09T22:00:00.000+00:00",
"title": "CVE-2025-27818"
},
{
"cve": "CVE-2025-27819",
"product_status": {
"known_affected": [
"67646",
"T035705",
"T045828",
"T045927",
"389168",
"T045928",
"T046468",
"T044458",
"T021399",
"T046469",
"T044459",
"T019704",
"T005180",
"T046467",
"T046654",
"1411051"
]
},
"release_date": "2025-06-09T22:00:00.000+00:00",
"title": "CVE-2025-27819"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…