CVE-2024-27309
highPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.011 · 66. PerzentilDEEUNLUSEPSS · bewertet 2026-10-27
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain). The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–7.4
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (24)
Betroffene Produkte und Versionsbereiche.
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:3.0.3.3.0:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:15.0.0.0:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:15.0.1.0:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:3.0.2.0.0:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:3.0.3.0.0:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:8.0.0.3:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:8.1.0.1:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:8.1.0.26:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.4.0:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.4.1:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.4.2:*:*:*:*:*:*:*
- communications_applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:7.5.0:*:*:*:*:*:*:*
- communications_service_catalog_and_designalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_service_catalog_and_design:8.1.0.1:*:*:*:*:*:*:*
- communications_service_catalog_and_designalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_service_catalog_and_design:8.0.0.3:*:*:*:*:*:*:*
- oracle communications applicationsalle Versionenncsc_nlNLcpe:2.3:a:oracle:communications_applications:*:*:*:*:*:*:*:*
Advisories (6)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.
- WID-SEC-W-2024-0857Apache Kafka: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2024-04-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Kafka ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-0135Oracle Communications Applications: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1564Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-79vv-vp32-gpp7Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode2024-04-12ghsa · osvUS
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are needed to trigger the bug: 1. The administrator decides to remove an ACL 2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct. The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain). The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.
- BIT-kafka-2024-273092024-04-16vendor · osvUS
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.Two preconditions are needed to trigger the bug:1. The administrator decides to remove an ACL2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.When those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.The incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).The full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2024/04/12/3cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-27309/cnnvd
- https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpycnnvd
- https://security.netapp.com/advisory/ntap-20240705-0002/cnnvd
- https://www.oracle.com/security-alerts/cpujan2025.htmlcnnvd
- https://www.oracle.com/security-alerts/cpujul2025.htmlcnnvd
- http://www.openwall.com/lists/oss-security/2024/04/12/3enisa_euvd
- https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpyenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan