CVE-2022-34917: Unauthenticated clients may cause OutOfMemoryError on brokers

[scholzj]

As you might have noticed, there is a new CVE in Apache Kafka: CVE-2022-34917. Kafka 3.2.3 and 3.1.2 support has been already merged into the main branch. Strimzi 0.31.1 with support for the new Kafka version will be released soon (expect the RC1 today or tomorrow).

For more details about the CVE, please see https://lists.apache.org/thread/cyj4wfwbyqdqssb2nwwwhxpy0nt5j320 and https://kafka.apache.org/cve-list.

[scholzj]

The 0.31.1-rc1 is not available for testing: https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.31.1-rc1

[scholzj]

Strimzi 0.31.1 is now released 🎉. It brings support for #ApacheKafka 3.1.2 and 3.2.3 with fixes the CVE-2022-34917 and a bunch of smaller improvements 🚀 and bug-fixes 🐞. Find out more about the new release on our GitHub: https://github.com/strimzi/strimzi-kafka-operator/releases/tag/0.31.1