PT-2022-21798 · Apache · Apache Pulsar Broker+2

Michael Marshall · Published 2022-09-23 · Updated 2022-09-27 · CVE-2022-33682

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.6.4 and earlier Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 through 2.7.4 Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.8.0 through 2.8.3 Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.9.0 through 2.9.2 Apache Pulsar Broker, Proxy, and WebSocket Proxy version 2.10.0

Description TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client, leaving intra-cluster connections and geo-replication connections vulnerable to man-in-the-middle attacks. This could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability affects both the pulsar+ssl protocol and HTTPS. An attacker must take control of a machine between the client and the server and actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host.

Recommendations For Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.6.4 and earlier, update to a version that includes the fix for this issue. For Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 through 2.7.4, update to a version that includes the fix for this issue. For Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.8.0 through 2.8.3, update to a version that includes the fix for this issue. For Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.9.0 through 2.9.2, update to a version that includes the fix for this issue. For Apache Pulsar Broker, Proxy, and WebSocket Proxy version 2.10.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable clients to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-33682

GHSA-JVF3-MFXV-JCQR

Affected Products

Apache Pulsar Broker

Apache Pulsar Proxy

Apache Pulsar Websocket Proxy

References · 6

• https://lists.apache.org/thread/l0ynfl161qghwfcgbbl8ld9hzbl9t3yx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33682 · Security Note
• https://osv.dev/vulnerability/GHSA-jvf3-mfxv-jcqr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33682 · Vendor Advisory
• https://t.me/cvenotify/36747 · Telegram Post
• https://t.me/cvenotify/36755 · Telegram Post