Skip to content

Conversation

renovate-bot
Copy link
Contributor

@renovate-bot renovate-bot commented Nov 6, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.apache.kafka:connect-api 3.9.0 -> 3.9.1 age adoption passing confidence
org.apache.kafka:kafka-clients 3.9.0 -> 3.9.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-27817

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products.

Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate-bot renovate-bot requested review from a team as code owners November 6, 2024 01:25
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Nov 6, 2024
@product-auto-label product-auto-label bot added the size: xs Pull request size is extra small. label Nov 6, 2024
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Nov 6, 2024
@renovate-bot renovate-bot changed the title deps: update kafka.version to v3.8.1 deps: update kafka.version to v3.9.0 Nov 7, 2024
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 4e9d071 to 67834ff Compare November 7, 2024 02:08
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Nov 7, 2024
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Nov 7, 2024
@renovate-bot renovate-bot changed the title deps: update kafka.version to v3.9.0 deps: update kafka.version May 19, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 67834ff to e22ab33 Compare May 19, 2025 17:46
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 19, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 19, 2025
@renovate-bot renovate-bot changed the title deps: update kafka.version deps: update kafka.version to v3.9.1 May 20, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from e22ab33 to fe3675c Compare May 20, 2025 06:59
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 20, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 20, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from fe3675c to 56349ba Compare May 30, 2025 21:08
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 30, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 30, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 56349ba to d46e163 Compare May 31, 2025 01:32
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 31, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 31, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from d46e163 to ae52ef0 Compare May 31, 2025 05:06
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 31, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 31, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from ae52ef0 to b96d96e Compare May 31, 2025 11:00
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 31, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label May 31, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from b96d96e to b0a9db4 Compare May 31, 2025 13:40
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 5, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 5, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 73a9c97 to 649fdb2 Compare September 5, 2025 18:24
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 5, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 5, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 649fdb2 to 3f6a43f Compare September 5, 2025 21:56
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 5, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 5, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 3f6a43f to abebcaf Compare September 6, 2025 00:56
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from abebcaf to abbc386 Compare September 6, 2025 04:46
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from abbc386 to 79eb40f Compare September 6, 2025 09:30
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 79eb40f to 2ba59e0 Compare September 6, 2025 12:28
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 2ba59e0 to 68b39a7 Compare September 6, 2025 17:29
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from 68b39a7 to f0c3f11 Compare September 6, 2025 20:55
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 6, 2025
@renovate-bot renovate-bot force-pushed the renovate/kafka.version branch from f0c3f11 to eceece3 Compare September 7, 2025 00:55
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 7, 2025
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
size: xs Pull request size is extra small.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants