Apache Software Foundation Apache Pulsar vulnerabilities

CVE-2024-29834 [MEDIUM] CWE-863 CVE-2024-29834: This vulnerability allows authenticated users with produce or consume permissions to perform unautho This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can creat

CVE-2024-27135 [HIGH] CWE-20 CVE-2024-27135: Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to exe Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue af

CVE-2024-27317 [HIGH] CWE-22 CVE-2024-27317: In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These file In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain spe

CVE-2024-27894 [HIGH] CWE-20 CVE-2024-27894: The Pulsar Functions Worker includes a capability that permits authenticated users to create functio The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will retrieve the implementation from the URL provided by the

CVE-2022-34321 [HIGH] CWE-306 CVE-2022-34321: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /p Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections without requiring proper authentication credentials. Th

CVE-2024-28098 [MEDIUM] CWE-863 CVE-2024-28098: The vulnerability allows authenticated users with only produce or consume permissions to modify topi The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to

CVE-2023-51437 [HIGH] CWE-203 CVE-2023-51437: Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleT

CVE-2023-30429 [CRITICAL] CWE-863 CVE-2023-30429: Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affec Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incor

CVE-2023-31007 [NONE] CWE-287 CVE-2023-31007: Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a cl Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially cra

CVE-2022-33684 [HIGH] CWE-295 CVE-2022-33684: The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the O The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or modify the GET request that is sent to the ClientCredent

CVE-2022-33683 [MEDIUM] CWE-295 CVE-2022-33683: Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer T Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, confi

CVE-2022-24280 [MEDIUM] CWE-20 CVE-2022-24280: Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to ma Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An at

CVE-2022-33682 [MEDIUM] CWE-295 CVE-2022-33682: TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data

CVE-2022-33681 [MEDIUM] CWE-295 CVE-2022-33681: Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vu Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication data is sent before verifying the server’s TLS certifi

CVE-2021-41571 [MEDIUM] CWE-863 CVE-2021-41571: In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics ac In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed aga

CVE-2021-22160 [CRITICAL] CWE-347 CVE-2021-22160: If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).