PT-2023-26015 · Apache · Apache Pulsar Websocket Proxy

Michael Marshall · Publicado 2023-12-20 · Atualizado 2024-01-04 · CVE-2023-37544

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Pulsar WebSocket Proxy versions 2.8.0 through 2.8.* Apache Pulsar WebSocket Proxy versions 2.9.0 through 2.9.* Apache Pulsar WebSocket Proxy versions 2.10.0 through 2.10.4 Apache Pulsar WebSocket Proxy versions 2.11.0 through 2.11.1 Apache Pulsar WebSocket Proxy version 3.0.0

Description An Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the "/pingpong" endpoint without authentication. The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

Recommendations For Apache Pulsar WebSocket Proxy versions 2.8.0 through 2.8., upgrade to at least version 2.10.5, 2.11.2, or 3.0.1. For Apache Pulsar WebSocket Proxy versions 2.9.0 through 2.9., upgrade to at least version 2.10.5, 2.11.2, or 3.0.1. For Apache Pulsar WebSocket Proxy versions 2.10.0 through 2.10.4, upgrade to at least version 2.10.5. For Apache Pulsar WebSocket Proxy versions 2.11.0 through 2.11.1, upgrade to at least version 2.11.2. For Apache Pulsar WebSocket Proxy version 3.0.0, upgrade to at least version 3.0.1.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-37544

GHSA-83Q5-WHQP-R8JR

Produtos afetados

Apache Pulsar Websocket Proxy

Referências · 15

• https://github.com/apache/pulsar · Nota
• https://github.com/apache/pulsar/commit/894192fb6542e504be43034a3c33e90f9c6e528a · Nota
• https://github.com/apache/pulsar/commit/eac263e8f2a93d3b9f707b97c7bbcbc2a826569f · Nota
• https://github.com/apache/pulsar/commit/11ee36d0351644a006d2a8639bdcc714fb602358 · Nota
• http://openwall.com/lists/oss-security/2023/12/20/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-37544 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-83q5-whqp-r8jr · Aviso do Fabricante
• https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-37544 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1737395544933167335 · Publicação no Twitter
• https://twitter.com/oss_security/status/1737458133885214764 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/1737776248347078853 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1737406647545299124 · Publicação no Twitter
• https://t.me/cvenotify/64361 · Publicação no Telegram
• https://t.me/cvenotify/66238 · Publicação no Telegram