CVE-2024-27309: 
Java vulnerability analysis and mitigation

CVE-2024-27309 is a critical vulnerability in Apache Kafka that affects versions 3.5.0, 3.5.1, 3.5.2, 3.6.0, and 3.6.1. The vulnerability emerges during the migration of an Apache Kafka cluster from ZooKeeper mode to KRaft mode, where Access Control Lists (ACLs) may not be correctly enforced under specific conditions (Security Online, Openwall).

The vulnerability is triggered when two specific preconditions are met: 1) an administrator removes an ACL, and 2) the resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal. When these conditions are met, Kafka incorrectly treats the resource as if it had only one ACL associated with it after the removal, rather than the actual number of remaining ACLs. The vulnerability has received a CVSS 3.1 base score of 7.4 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

The severity of the impact varies depending on the ACL configuration. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability issues. However, if DENY ACLs were configured, the impact could be more severe, potentially including unauthorized access to sensitive data and compromise of data integrity, as the DENY ACLs might be ignored during the migration period (Openwall).

The incorrect condition persists during the migration process but can be cleared either by removing all brokers in ZK mode or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss as all ACLs remain intact (NVD).

Organizations using affected versions of Apache Kafka should carefully plan their ZooKeeper to KRaft mode migrations. The vulnerability can be addressed by either removing all brokers in ZK mode or by adding a new ACL to the affected resource. It's recommended to upgrade to a patched version of Kafka when available (Security Online).