@yangzhao_kl ,@wuzeyi1 ,@macchen1 ,@my_code_x
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后cve-manager将无法正常解析填写内容.
影响性分析说明:
openEuler评分: (评分和向量)
受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP1(2.8.2):
2.openEuler-20.03-LTS-SP3(2.8.2):
3.openEuler-22.03-LTS(2.6.0):
4.openEuler-22.03-LTS-SP1(2.8.2):
修复是否涉及abi变化(是/否)：
1.openEuler-20.03-LTS-SP1(2.8.2):
2.openEuler-20.03-LTS-SP3(2.8.2):
3.openEuler-22.03-LTS(2.6.0):
4.openEuler-22.03-LTS-SP1(2.8.2):
issue处理具体操作请参考:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142
| 参考网址 | 关联pr | 状态 | 补丁链接 |
|---|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-25194 | |||
| https://www.opencve.io/cve/CVE-2023-25194 | |||
| https://nvd.nist.gov/vuln/detail/CVE-2023-25194 | |||
| https://security-tracker.debian.org/tracker/CVE-2023-25194 | |||
| https://ubuntu.com/security/CVE-2023-25194 | None | None | https://discourse.ubuntu.com/c/ubuntu-pro |
| http://www.cnnvd.org.cn/web/vulnerability/queryLds.tag?qcvCnnvdid=CVE-2023-25194 |
说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1
@yangzhao_kl 该CVE受影响版本为2.3.0 <= Apache Kafka <= 3.3.2，是否可以考虑升级到3.4.0来解决该问题?
新版本下载地址：https://kafka.apache.org/downloads
@yangzhao_kl 这个漏洞有没有最新的修复计划？
经过cve-manager解析，(所有PR均已合入)
一、漏洞信息
漏洞编号：CVE-2023-25194
漏洞归属组件：kafka
漏洞归属的版本：2.4.0,2.8.1,2.8.2
CVSS评分：
BaseScore：8.8 High
Vector：CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞简述：
A possible security vulnerability has been identified in Apache Kafka Connect API.This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS configand a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the
sasl.jaas.configproperty for any of the connector s Kafka clients to com.sun.security.auth.module.JndiLoginModule , which can be done via theproducer.override.sasl.jaas.config,consumer.override.sasl.jaas.config, oradmin.override.sasl.jaas.configproperties.This will allow the server to connect to the attacker s LDAP serverand deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-boxconfigurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connectorclient override policy that permits them.Since Apache Kafka 3.4.0, we have added a system property ( -Dorg.apache.kafka.disallowed.login.modules ) to disable the problematic login modules usagein SASL JAAS configuration. Also by default com.sun.security.auth.module.JndiLoginModule is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,in addition to leveraging the org.apache.kafka.disallowed.login.modules system property, Kafka Connect users can also implement their own connectorclient config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.漏洞公开时间：2023-02-08 04:15:09
漏洞创建时间：2025-03-25 23:31:03
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2023-25194
更多参考(点击展开)
漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：
详情(点击展开)
二、漏洞分析结构反馈
影响性分析说明：
CVE-2023-25194 是 Kafka Connect 侧 JNDI 注入:认证操作员可通过 connector 配置的 producer.override/consumer.override 注入恶意 SASL JAAS 配置触发 JndiLoginModule。上游修复机制为 org.apache.kafka.disallowed.login.modules 默认禁用（Kafka 3.4.0 引入），已合入的 CVE-2025-27818/27819 补丁（0023）为同一机制的超集（同时禁用 JndiLoginModule 与 LdapLoginModule）。
openEuler评分：
8.8
Vector：CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
受影响版本排查(受影响/不受影响)：
1.master(2.8.2):受影响
2.openEuler-20.03-LTS-SP4(2.8.2):受影响
3.openEuler-22.03-LTS-SP3(2.8.2):受影响
4.openEuler-22.03-LTS-SP4(2.8.2):受影响
5.openEuler-24.03-LTS(2.8.2):受影响
6.openEuler-24.03-LTS-Next(2.8.2):受影响
7.openEuler-24.03-LTS-SP1(2.8.2):受影响
8.openEuler-24.03-LTS-SP2(2.8.2):受影响
9.openEuler-24.03-LTS-SP3(2.8.2):受影响
10.openEuler-24.03-LTS-SP4(2.8.2):受影响
修复是否涉及abi变化(是/否)：
1.master(2.8.2):否
2.openEuler-20.03-LTS-SP4(2.8.2):否
3.openEuler-22.03-LTS-SP3(2.8.2):否
4.openEuler-22.03-LTS-SP4(2.8.2):否
5.openEuler-24.03-LTS(2.8.2):否
6.openEuler-24.03-LTS-Next(2.8.2):否
7.openEuler-24.03-LTS-SP1(2.8.2):否
8.openEuler-24.03-LTS-SP2(2.8.2):否
9.openEuler-24.03-LTS-SP3(2.8.2):否
10.openEuler-24.03-LTS-SP4(2.8.2):否
原因说明：
1.master(2.8.2):正常修复
2.openEuler-20.03-LTS-SP4(2.8.2):正常修复
3.openEuler-22.03-LTS-SP3(2.8.2):不修复-超出修复范围
4.openEuler-22.03-LTS-SP4(2.8.2):正常修复
5.openEuler-24.03-LTS(2.8.2):不修复-超出修复范围
6.openEuler-24.03-LTS-Next(2.8.2):正常修复
7.openEuler-24.03-LTS-SP1(2.8.2):正常修复
8.openEuler-24.03-LTS-SP2(2.8.2):不修复-超出修复范围
9.openEuler-24.03-LTS-SP3(2.8.2):正常修复
10.openEuler-24.03-LTS-SP4(2.8.2):正常修复