What Your Latest Update Might Have Missed
This week, we’re looking at a Kafka flaw that could let attackers pose as other users, a Brotli bug being used in attacks, and a warning to check before restarting some Hetzner servers.
Yours in Open Source,
Dave Wreski, Founder
Kafka Could Accept a Fake Login
A flaw in one Kafka login setup could let an attacker sign in as someone else, including an administrator. Apache has released fixes and a change to the login settings that blocks the problem without an upgrade. Not every Kafka server is affected.
A Linux Update May Leave an App Unpatched
Attackers are using a flaw in Brotli, software that unpacks compressed data. Some apps include their own copy, which a Linux system update will not replace. Check the copy your app actually uses, including apps running inside containers.
Check Before Rebooting an Affected Hetzner Server
Hetzner is warning some customers to avoid reboots because a flaw can be exploited during network boot, before Linux starts. Already-running systems are not directly at risk from this bug. The warning covers affected dedicated servers during reboots and affected cloud machines when starting the Rescue System.
