E-MapReduce:Vulnerability notice | RCE vulnerability in Apache Kafka Connect

Impacts

• Affected Apache Kafka versions: 2.3.0 to 3.3.2

• Affected E-MapReduce (EMR) versions:

  • EMR 5.X series: versions earlier than EMR V5.16.0

  • EMR 3.X series: versions earlier than EMR V3.50.0

  Note

  The vulnerability is fixed in EMR V3.50.0, EMR V5.16.0, or a minor version later than EMR V3.50.0 or EMR V5.16.0. In these versions, you do not need to manually fix the vulnerability.

Fixing procedure

The method of fixing the vulnerability varies based on the type of the cluster in which Kafka is deployed.

(Optional) Subsequent O&M

If Kafka brokers need to be added to your cluster, you can perform the preceding steps to fix the vulnerability on new core nodes on which Kafka brokers are deployed. You can also use the EMR cluster script feature to fix the vulnerability on new nodes during the scale-out process.

1. Upload the Kafka software package to the Object Storage Service (OSS) console. For more information, see Simple upload.

   For example, upload the kafka-2.12-2.4.1-1.1.5.tar.gz package to the oss://emr-kafka-software/ directory.

2. Create a script file named upgrade_kafka_software.sh and upload the script file to OSS for subsequent addition of a bootstrap action.

   #!/bin/bash
   sudo su - kafka
   
   #upgrade_kafka_software.sh
   #pls update the vars before use:
   #KAFKA_HOME,OSS_HOST,OSS_AK,OSS_SK,OSS_DIR,OSS_FILE
   KAFKA_HOME="/opt/apps/KAFKA"
   OSS_HOST=<yourEndPoint>
   OSS_AK=<yourAccessKeyId>
   OSS_SK=<yourAccessKeySecret>
   #yourOssDir, e.g.:emr-kafka-software
   OSS_DIR=<yourOssDir>
   #change to your kafka version
   OSS_FILE=<yourOssFile>
   
   if [ -f ${KAFKA_HOME}/${OSS_FILE} ]; then
    echo "file exist, no action to do"
    exit 0
   fi
   
   sudo /usr/local/bin/ossutil64 -i $OSS_AK -k $OSS_SK -e $OSS_HOST cp oss://${OSS_DIR}/${OSS_FILE} ${KAFKA_HOME}/${OSS_FILE}
   
   cd ${KAFKA_HOME}
   #change to your kafka version
   sudo mkdir kafka-2.12-2.4.1-1.1.5
   #change to your kafka version
   sudo chown kafka:hadoop kafka-2.12-2.4.1-1.1.5
   tar xvf kafka-2.12-2.4.1-1.1.5.tar.gz
   
   sudo rm -f kafka-current
   sudo ln -s /opt/apps/KAFKA/kafka-2.12-2.4.1-1.1.5 kafka-current
   
   exit 0

   The following table describes the parameters in the code. Replace the values of the parameters with actual values.

   Note

   The name of the newly created directory must be the same as the name of the Kafka software package. In this example, the name of the directory is kafka-2.12-2.4.1-1.1.5. You can replace the name based on your business requirements.

   Parameter	Description
   KAFKA_HOME	The directory where the Kafka software package is stored.
   OSS_HOST	The internal endpoint of Alibaba Cloud OSS. Example: oss-cn-hangzhou-internal.aliyuncs.com.
   OSS_AK	The AccessKey ID and AccessKey secret that are used to access Alibaba Cloud OSS. For information about how to create and view an AccessKey pair, see Create an AccessKey pair.
   OSS_SK
   OSS_DIR	The directory in the OSS bucket. Replace the value of this parameter with the directory where the Kafka software package is stored in Alibaba Cloud OSS. Example: oss://emr-kafka-software/.
   OSS_FILE	The name of the Kafka software package in Alibaba Cloud OSS. Replace the value of this parameter with the name of the Kafka software package that you downloaded. Example: kafka-2.12-2.4.1-1.1.5.tar.gz.

3. Add a bootstrap action.

   Add a bootstrap action in the EMR console. For more information, see Manage bootstrap actions.

   Parameter	Description
   Script Address	The OSS path where the script file upgrade_kafka_software.sh is located.
   Execution Scope	Select Node Group from the Execution Scope drop-down list and then select emr-core.
   Execution Time	Select Before Component Installation.

References

For information about how to scale out a cluster, see Scale out an EMR cluster.