PT-2021-3274 · Apache · Apache Pulsar

Michael Marshall · Published 2021-05-25 · Updated 2022-06-04 · CVE-2021-22160

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Pulsar (affected versions not specified)

Description The issue is related to the authentication mechanism in Apache Pulsar when using JSON Web Tokens (JWT) for client authentication. If the algorithm of the presented token is set to "none", the signature of the token is not validated. This allows an attacker to connect to Pulsar instances as any user, including administrators. The vulnerability is associated with incorrect validation of the cryptographic signature, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2021-03036

CVE-2021-22160

GHSA-3CV4-XXV7-934Q

Affected Products

Apache Pulsar

References · 25

• https://nvd.nist.gov/vuln/detail/CVE-2021-22160 · Security Note
• https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973dab7e54717bbc7923fab1%40%3Cdev.pulsar.apache.org%3E · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03036 · Security Note
• https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22160 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3cv4-xxv7-934q · Vendor Advisory
• https://github.com/apache/pulsar/releases/tag/v2.7.2 · Note
• https://lists.apache.org/thread.html/r8e545559781231a83bf0644548c660255859e52feb86bbfcd42590da@%3Cdev.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550@%3Cusers.pulsar.apache.org%3E · Note
• https://t.me/cvenotify/15179 · Telegram Post
• https://lists.apache.org/thread.html/rca54f4b26ba5e6f2e39732b47ec51640e89f57e3b6a38ac3bab314df%40%3Cdev.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550%40%3Cdev.pulsar.apache.org%3E · Note
• https://t.me/cvenotify/15610 · Telegram Post
• https://lists.apache.org/thread.html/re2ae364e0c02093dc721699698c6f23cfbba0220c78b5e28cafeae81@%3Ccommits.pulsar.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf54fefc25c49d4715d484133d438f13bf2e515a5fed5d3a745d4f6e7@%3Ccommits.pulsar.apache.org%3E · Note