PT-2023-6483 · Apache · Apache Pulsar

Michael Marshall · Publicado 2023-07-11 · Atualizado 2023-07-20 · CVE-2023-31007

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions through 2.9.4 Apache Pulsar versions from 2.10.0 through 2.10.3 Apache Pulsar version 2.11.0

Description The issue is related to an improper authentication vulnerability in Apache Pulsar Broker, allowing a client to stay connected to a broker after authentication data expires. This can occur if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false, or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.

Recommendations Apache Pulsar version 2.9 users should upgrade to at least version 2.9.5. Apache Pulsar version 2.10 users should upgrade to at least version 2.10.4. Apache Pulsar version 2.11 users should upgrade to at least version 2.11.1. Any users running Apache Pulsar for versions 2.8 and earlier should upgrade to one of the above patched versions.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2023-07217

CVE-2023-31007

GHSA-47R2-PHR8-M8CP

Produtos afetados

Apache Pulsar

Referências · 10

• https://github.com/apache/pulsar · Nota
• https://vuldb.com/ru/?id.233754 · Nota
• https://t.me/cvenotify/54127 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-47r2-phr8-m8cp · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-07217 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-31007 · Nota de Segurança
• https://lists.apache.org/thread/qxn99xxyp0zv6jchjggn3soyo5gvqfxj · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-31007 · Aviso do Fabricante
• https://t.me/cvenotify/54769 · Publicação no Telegram
• https://t.me/cibsecurity/66533 · Publicação no Telegram