PT-2024-2609 · Apache · Apache Pulsar

Lari Hotari · Published 2024-03-12 · Updated 2025-01-22 · CVE-2024-27135

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions 2.4.0 through 2.10.5 Apache Pulsar versions 2.11.0 through 2.11.3 Apache Pulsar versions 3.0.0 through 3.0.2 Apache Pulsar versions 3.1.0 through 3.1.2 Apache Pulsar version 3.2.0

Description The issue is related to improper input validation in the Pulsar Function Worker, allowing a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".

Recommendations Apache Pulsar version 2.10 users should upgrade to at least version 2.10.6. Apache Pulsar version 2.11 users should upgrade to at least version 2.11.4. Apache Pulsar version 3.0 users should upgrade to at least version 3.0.3. Apache Pulsar version 3.1 users should upgrade to at least version 3.1.3. Apache Pulsar version 3.2 users should upgrade to at least version 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Fix

RCE

Weakness Enumeration

CWE-913

CWE-20

Related Identifiers

BDU:2024-02676

CVE-2024-27135

GHSA-XP2R-G8QQ-44HH

Affected Products

Apache Pulsar

References · 17

• https://osv.dev/vulnerability/GHSA-xp2r-g8qq-44hh · Vendor Advisory
• https://pulsar.apache.org/security/CVE-2024-27135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27135 · Security Note
• https://bdu.fstec.ru/vul/2024-02676 · Security Note
• https://lists.apache.org/thread/dh8nj2vmb2br6thjltq74lk9jxkz62wn · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27135 · Vendor Advisory
• https://github.com/apache/pulsar · Note
• https://twitter.com/CVEnew/status/1767620969789559159 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767606835781980305 · Twitter Post
• https://t.me/pentestingnews/44650 · Telegram Post
• https://twitter.com/fletch_ai/status/1768473962600714422 · Twitter Post
• https://t.me/cvenotify/73705 · Telegram Post
• https://t.me/cvenotify/108282 · Telegram Post
• https://twitter.com/socradar/status/1768250147421425871 · Twitter Post
• https://twitter.com/oss_security/status/1767597926623121453 · Twitter Post