# CVE-2021-38153 Security issue in Searchguard package

**URL:** <https://forum.search-guard.com/t/cve-2021-38153-security-issue-in-searchguard-package/2399>\
**Category:** Search Guard\
**Created:** [February 8, 2023, 7:31pm UTC](https://forum.search-guard.com/t/cve-2021-38153-security-issue-in-searchguard-package/2399 "2023-02-08T19:31:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arthurpapanyan](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/arthurpapanyan/32/1154_2.png) [@arthurpapanyan](https://forum.search-guard.com/u/arthurpapanyan)\
**Post date:** [February 8, 2023, 7:31pm UTC](https://forum.search-guard.com/t/cve-2021-38153-security-issue-in-searchguard-package/2399/1 "2023-02-08T19:31:23Z")

</div>

Our Security scans detected Security vulnerability on package that is used in serchgurad.  
Could you please upgrade this package to resolve the issue, state that Searchguard is not vulnerable with this.

**Describe the issue:**  
[org.apache.kafka:kafka-clients](http://kafka.apache.org/)

Affected versions of this package are vulnerable to Timing Attack. Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to brute force attacks by malicious users.

**Resolution**

Upgrade `org.apache.kafka:kafka-clients` to version 2.8.1, 2.7.2 or higher.  
Severity: High

Path: `search-guard-7/kafka-clients-2.5.1.jar`  
ID: VULNDB-268486, CVE-2021-38153

---

<div class="post-metadata">

**Author:** ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)\
**Post date:** [February 10, 2023, 9:29am UTC](https://forum.search-guard.com/t/cve-2021-38153-security-issue-in-searchguard-package/2399/2 "2023-02-10T09:29:23Z")

</div>

Which version of Search Guard are you using? Search Guard FLX 1.0.0 does not have any dependency on the kafka-clients component.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [March 3, 2023, 9:30am UTC](https://forum.search-guard.com/t/cve-2021-38153-security-issue-in-searchguard-package/2399/3 "2023-03-03T09:30:22Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.