[
https://issues.apache.org/jira/browse/KAFKA-20815?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097890#comment-18097890
]
Gergely Harmadás edited comment on KAFKA-20815 at 7/21/26 2:51 PM:
-------------------------------------------------------------------
Hi [~mimaison], I have started looking at the issue and it seems Kafka uses the
[jline bundle|https://mvnrepository.com/artifact/org.jline/jline] dependency
[here|https://github.com/apache/kafka/blob/ebac341b28d4224c296ada31eb45122176e8b27b/gradle/dependencies.gradle#L188]
which contains binaries corresponding to telnet. Probably we can reduce the
attack surface by not using the whole jline bundle. If I am correct jline is
only needed for the metadata shell which does not have remote capabilities,
only needs it for basic terminal stuff. I will continue the investigation and
try to submit a fix
{noformat}
jar tf ~/Downloads/jline-3.30.4.jar | grep -i telnet
META-INF/maven/org.jline/jline-remote-telnet/
org/jline/builtins/telnet/
META-INF/maven/org.jline/jline-remote-telnet/pom.properties
META-INF/maven/org.jline/jline-remote-telnet/pom.xml
org/jline/builtins/telnet/Connection$1.class
org/jline/builtins/telnet/Connection.class
org/jline/builtins/telnet/ConnectionData.class
org/jline/builtins/telnet/ConnectionEvent$Type.class
org/jline/builtins/telnet/ConnectionEvent.class
org/jline/builtins/telnet/ConnectionFilter.class
org/jline/builtins/telnet/ConnectionListener.class
org/jline/builtins/telnet/ConnectionManager.class
org/jline/builtins/telnet/PortListener.class
org/jline/builtins/telnet/Telnet$1$1$1.class
org/jline/builtins/telnet/Telnet$1$1$2.class
org/jline/builtins/telnet/Telnet$1$1$3.class
org/jline/builtins/telnet/Telnet$1$1.class
org/jline/builtins/telnet/Telnet$1.class
org/jline/builtins/telnet/Telnet$ShellProvider.class
org/jline/builtins/telnet/Telnet.class
org/jline/builtins/telnet/TelnetIO$IACHandler.class
org/jline/builtins/telnet/TelnetIO.class{noformat}
was (Author: JIRAUSER306203):
Hi [~mimaison], I have started looking at the issue and it seems Kafka uses the
[jline bundle|https://mvnrepository.com/artifact/org.jline/jline] dependency
[here|https://github.com/apache/kafka/blob/ebac341b28d4224c296ada31eb45122176e8b27b/gradle/dependencies.gradle#L188]
which contains binaries corresponding to telnet. Probably we can reduce the
attack surface by not using the whole jline bundle. I will continue the
investigation and try to submit a fix
{noformat}
jar tf ~/Downloads/jline-3.30.4.jar | grep -i telnet
META-INF/maven/org.jline/jline-remote-telnet/
org/jline/builtins/telnet/
META-INF/maven/org.jline/jline-remote-telnet/pom.properties
META-INF/maven/org.jline/jline-remote-telnet/pom.xml
org/jline/builtins/telnet/Connection$1.class
org/jline/builtins/telnet/Connection.class
org/jline/builtins/telnet/ConnectionData.class
org/jline/builtins/telnet/ConnectionEvent$Type.class
org/jline/builtins/telnet/ConnectionEvent.class
org/jline/builtins/telnet/ConnectionFilter.class
org/jline/builtins/telnet/ConnectionListener.class
org/jline/builtins/telnet/ConnectionManager.class
org/jline/builtins/telnet/PortListener.class
org/jline/builtins/telnet/Telnet$1$1$1.class
org/jline/builtins/telnet/Telnet$1$1$2.class
org/jline/builtins/telnet/Telnet$1$1$3.class
org/jline/builtins/telnet/Telnet$1$1.class
org/jline/builtins/telnet/Telnet$1.class
org/jline/builtins/telnet/Telnet$ShellProvider.class
org/jline/builtins/telnet/Telnet.class
org/jline/builtins/telnet/TelnetIO$IACHandler.class
org/jline/builtins/telnet/TelnetIO.class{noformat}
> Security : [jline-remote-telnet] [3.30.4]
> ------------------------------------------
>
> Key: KAFKA-20815
> URL: https://issues.apache.org/jira/browse/KAFKA-20815
> Project: Kafka
> Issue Type: Bug
> Reporter: Krishna Chidrawar
> Priority: Critical
> Labels: security
>
> h2. GHSA-47qp-hqvx-6r3f :
> The JLine3 Telnet server (`remote-telnet` module) does not limit the number of
> environment variables a client may inject via the Telnet NEW-ENVIRON option.
> An
> unauthenticated attacker can flood the server with a large number of unique
> variable pairs before sending the terminating IAC SE byte, exhausting JVM heap
> *URL :* [https://github.com/advisories/GHSA-47qp-hqvx-6r3f]
> *Fix Version :* 4.2.1
> h2. GHSA-2r2c-cx56-8933:
> The JLine3 Telnet server (`remote-telnet` module) does not apply an upper
> bound to
> terminal dimensions received via the Telnet NAWS (Negotiate About Window
> Size) option.
> An unauthenticated remote attacker can send a NAWS subnegotiation advertising
> a
> 65535×65535 terminal and repeatedly alternate values to trigger continuous,
> expensive
> *URL :* [https://github.com/advisories/GHSA-2r2c-cx56-8933]
> *Fix Version :* 4.2.1
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
