Impacted versions:
- Confluent Platform <= 8.3.0, 8.2.2, 8.1.4, 8.0.6, 7.9.8, 7.8.9, 7.7.10, 7.6.12, 7.5.15
- Confluent Cloud Schema Registry clusters
Recommended action:
- Confluent Cloud customers do not need to take any action. Confluent has patched all impacted Schema Registry clusters.
- Confluent Platform customers should upgrade to the latest patched release versions >= 7.5.16, 7.6.13, 7.7.11, 7.8.10, 7.9.9, 8.0.7, 8.1.5, 8.2.3, 8.3.1
Issue:
Schema Registry supports remotely hosted schema references through fields such as $ref and $dynamicRef in JSON schemas. Although those external sub-schemas are not incorporated into the final constructed schema, the service still fetches them over the network and processes the response in memory. An authenticated attacker can exploit this behavior by registering a schema that references a very large remotely hosted schema, which can trigger a denial-of-service condition. and impact other tenants sharing the same physical Schema Registry cluster in Confluent Cloud. An attacker can also force server-side requests to arbitrary endpoints using references but we did not find any impact due to this vector in Confluent Cloud.
Remediation:
-
Confluent Platform
- This issue is resolved in the following versions of Confluent Platform versions >= 7.5.16, 7.6.13, 7.7.11, 7.8.10, 7.9.9, 8.0.7, 8.1.5, 8.2.3, 8.3.1
- Set schema.providers.json.fetch.remote.schemas to false to disable fetching external schemas via references: https://docs.confluent.io/platform/current/schema-registry/installation/config.html#schema-providers-json-fetch-remote-schemas. Please check the respective version of the documentation to match the Confluent Platform deployment.
-
Confluent Cloud
- Confluent has patched all impacted Schema Registry clusters by disallowing external JSON Schema references.
CVSS Scores:
-
Confluent Cloud:
- CVSS: 6.5 (CVSS v3.1 Calculator)
-
Confluent Platform:
- CVSS: 5.7 (CVSS v3.1 Calculator)