PT-2023-4090 · Apache · Apache Pulsar

Michael Marshall · Published 2023-07-12 · Updated 2023-07-20 · CVE-2023-37579

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions prior to 2.10.4 Apache Pulsar version 2.11.0 Apache Pulsar versions 2.9.* and earlier

Description The issue is related to an Incorrect Authorization vulnerability in Apache Pulsar Function Worker, which can allow a remote attacker to access the configuration of the cloud platform. Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization, potentially leading to leaked credentials. The vulnerability is mitigated by the fact that there is no known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability.

Recommendations For Apache Pulsar version 2.10, upgrade to at least version 2.10.4. For Apache Pulsar version 2.11, upgrade to at least version 2.11.1. For Apache Pulsar versions 2.9.* and earlier, upgrade to one of the above patched versions. Note that Apache Pulsar version 3.0 is unaffected.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2023-04392

CVE-2023-37579

GHSA-74MC-G2XV-PCH2

Affected Products

Apache Pulsar

References · 8

• https://bdu.fstec.ru/vul/2023-04392 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-37579 · Security Note
• https://lists.apache.org/thread/0dmn3cb5n2p08o3cpj3ycfhzfqs2ppwz · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-74mc-g2xv-pch2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37579 · Vendor Advisory
• https://github.com/apache/pulsar · Note
• https://t.me/cvenotify/54780 · Telegram Post
• https://t.me/cibsecurity/66527 · Telegram Post