Apache Kafka Connect remote code execution vulnerability warning

Respectful master's command:

   Hello! Recently, Apache Kafka officially issued a security bulletin, disclosing that there is a remote code execution vulnerability (CVE-2023-25194) in a specific version of Apache Kafka. The POC has been made public and the risk is high.

[Vulnerability Rating]

High risk

[Vulnerability description]

CVE-2023-25194

Apache Kafka is a distributed data stream processing platform, and Kafka Connect is a tool for transferring data between Apache Kafka and other data systems in a scalable and reliable manner. When a connector is configured via the Kafka Connect REST API, an authenticated attacker can conduct a JNDI injection attack by modifying the connector's Kafka client property configuration, ultimately leading to the execution of arbitrary code on the target server.

[scope of influence]

affected version

Apache Kafka 2.3.0 - 3.3.2

[Repair Plan]

Currently, the official has released a new version to fix the vulnerability. Affected users are asked to upgrade to a safe version:

https://github.com/apache/Kafka/tags

[Reference link]

https://kafka.apache.org/cve-list

https://lists.apache.org/thread/rn8vn4d9dbxc6817c5wz1dhhoshp1s25