REDHAT-BUG-2487375: High severity Spring Spring for Apache Kafka vulnerability
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487375?
The severity of REDHAT-BUG-2487375 is high with a score of 7.
What issues does REDHAT-BUG-2487375 present?
REDHAT-BUG-2487375 allows crafted headers to be processed as trusted due to improper prefix checking in header mapping.
How do I fix REDHAT-BUG-2487375?
To fix REDHAT-BUG-2487375, update your Spring for Apache Kafka dependency to the latest version that addresses this vulnerability.
What software is affected by REDHAT-BUG-2487375?
REDHAT-BUG-2487375 affects Spring for Apache Kafka.
What is the impact of the vulnerability described in REDHAT-BUG-2487375?
The impact of REDHAT-BUG-2487375 is that it can lead to arbitrary code execution through deserialization vulnerabilities.