PT-2023-6483 · Apache · Apache Pulsar

Michael Marshall · Published 2023-07-11 · Updated 2023-07-20 · CVE-2023-31007

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions through 2.9.4 Apache Pulsar versions from 2.10.0 through 2.10.3 Apache Pulsar version 2.11.0

Description The issue is related to an improper authentication vulnerability in Apache Pulsar Broker, allowing a client to stay connected to a broker after authentication data expires. This can occur if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false, or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.

Recommendations Apache Pulsar version 2.9 users should upgrade to at least version 2.9.5. Apache Pulsar version 2.10 users should upgrade to at least version 2.10.4. Apache Pulsar version 2.11 users should upgrade to at least version 2.11.1. Any users running Apache Pulsar for versions 2.8 and earlier should upgrade to one of the above patched versions.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-07217

CVE-2023-31007

GHSA-47R2-PHR8-M8CP

Affected Products

Apache Pulsar

References · 10

• https://osv.dev/vulnerability/GHSA-47r2-phr8-m8cp · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07217 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-31007 · Security Note
• https://lists.apache.org/thread/qxn99xxyp0zv6jchjggn3soyo5gvqfxj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31007 · Vendor Advisory
• https://github.com/apache/pulsar · Note
• https://vuldb.com/ru/?id.233754 · Note
• https://t.me/cvenotify/54127 · Telegram Post
• https://t.me/cvenotify/54769 · Telegram Post
• https://t.me/cibsecurity/66533 · Telegram Post