Executive Summary

The vulnerability exists in kafka-python versions prior to 2.3.2 within the SCRAM authentication handling process. A malicious or man-in-the-middle broker can exploit this by providing an excessively large iteration count during authentication. This iteration count is passed directly to the hashlib.pbkdf2_hmac() function without any validation, which causes the client event loop to freeze.

As a result, critical operations such as producer sends, consumer polls, admin operations, and heartbeats are blocked, potentially causing consumer group eviction and repeated reconnect failures.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial-of-service condition by freezing the kafka-python client event loop. This means that important Kafka client operations like sending messages, polling for messages, administrative tasks, and maintaining heartbeats can be blocked.

The impact includes consumer group eviction and repeated reconnect failures, which can disrupt the normal functioning of Kafka clients and potentially lead to service outages or degraded performance.

Useful 0 Not Useful 0