PT-2023-4090 · Apache · Apache Pulsar

Michael Marshall · Publicado 2023-07-12 · Atualizado 2023-07-20 · CVE-2023-37579

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions prior to 2.10.4 Apache Pulsar version 2.11.0 Apache Pulsar versions 2.9.* and earlier

Description The issue is related to an Incorrect Authorization vulnerability in Apache Pulsar Function Worker, which can allow a remote attacker to access the configuration of the cloud platform. Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization, potentially leading to leaked credentials. The vulnerability is mitigated by the fact that there is no known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability.

Recommendations For Apache Pulsar version 2.10, upgrade to at least version 2.10.4. For Apache Pulsar version 2.11, upgrade to at least version 2.11.1. For Apache Pulsar versions 2.9.* and earlier, upgrade to one of the above patched versions. Note that Apache Pulsar version 3.0 is unaffected.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2023-04392

CVE-2023-37579

GHSA-74MC-G2XV-PCH2

Produtos afetados

Apache Pulsar

Referências · 8

• https://github.com/apache/pulsar · Nota
• https://bdu.fstec.ru/vul/2023-04392 · Nota de Segurança
• https://t.me/cvenotify/54780 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37579 · Nota de Segurança
• https://lists.apache.org/thread/0dmn3cb5n2p08o3cpj3ycfhzfqs2ppwz · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-74mc-g2xv-pch2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-37579 · Aviso do Fabricante
• https://t.me/cibsecurity/66527 · Publicação no Telegram