PT-2022-21797 · Apache · Apache Pulsar Java Client

Michael Marshall · Published 2022-09-23 · Updated 2022-09-27 · CVE-2022-33681

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Pulsar Java Client versions 2.6.4 and earlier Apache Pulsar Java Client versions 2.7.0 through 2.7.4 Apache Pulsar Java Client versions 2.8.0 through 2.8.3 Apache Pulsar Java Client versions 2.9.0 through 2.9.2 Apache Pulsar Java Client version 2.10.0

Description Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy makes each client vulnerable to a man-in-the-middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication data is sent before verifying the server’s TLS certificate matches the hostname, which means authentication data could be exposed to an attacker. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. Because the client sends authentication data before performing hostname verification, an attacker could gain access to the client’s authentication data. Token-based authentication and username/password authentication methods are vulnerable because the authentication data can be used to impersonate the client in a separate session.

Recommendations For Apache Pulsar Java Client versions 2.6.4 and earlier, update to a version that includes the fix for this issue. For Apache Pulsar Java Client versions 2.7.0 through 2.7.4, update to a version that includes the fix for this issue. For Apache Pulsar Java Client versions 2.8.0 through 2.8.3, update to a version that includes the fix for this issue. For Apache Pulsar Java Client versions 2.9.0 through 2.9.2, update to a version that includes the fix for this issue. For Apache Pulsar Java Client version 2.10.0, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling token-based authentication and username/password authentication methods until a patch is available. Restrict access to the Pulsar Broker/Proxy to minimize the risk of exploitation. Avoid using vulnerable authentication methods in the affected API endpoints until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-33681

GHSA-C5FP-X2H5-VJV7

Affected Products

Apache Pulsar Java Client

References · 7

• https://lists.apache.org/thread/fpo6x10trvn20hlk0dmnr5vlz5v4kl3d · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33681 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33681 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c5fp-x2h5-vjv7 · Vendor Advisory
• https://github.com/apache/pulsar/tree/db26073728bf86fc80deecaece2dc02b50bbb9b5/pulsar-client · Note
• https://t.me/cvenotify/36748 · Telegram Post
• https://t.me/cvenotify/36756 · Telegram Post