A flaw was found in dom4j library. By using the default SaxReader() provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.

dom4j could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation in multiple methods. By sending a specially-crafted XML content, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Apache Kafka before versions 0.10.2.2, 0.11.0.3, 1.0.1 and 1.1.0 allow users to perform actions reserved for the Broker via manually created fetch requests that interfere with data replication, resulting in data loss.

External Reference:

https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef@%3Cusers.kafka.apache.org%3E

Upstream Patches:

https://github.com/apache/kafka/commit/d2932ad370c5b56edac9d99e6d75f199537a569f https://github.com/apache/kafka/commit/580f743c3ce633241d6076ce83fb778cea86a1f6 https://github.com/apache/kafka/commit/51f0f3ee792cf9352ce61afeca098c765cdad664