Non notée
CVE-2022-24280 Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection…
Description
Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An attacker could use this as a way for DoS attacks that originate from the Pulsar Proxy's IP address. It hasn’t been detected that the Pulsar Proxy authentication can be bypassed. The attacker will have to have a valid token to a properly secured Pulsar Proxy. This issue affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.2; 2.9.0 to 2.9.1; 2.6.4 and earlier.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Pulsar 2.9 | 2.9 → 2.9.1 | Pas de correctif indiqué |
| Apache Pulsar 2.8 | 2.8 → 2.8.2 | Pas de correctif indiqué |
| Apache Pulsar 2.7 | 2.7 → 2.7.4 | Pas de correctif indiqué |
| Apache Pulsar 2.6 | premières → 2.6.4 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Pulsar
Les 30 CVE de Apache Pulsar →
CVE-2026-105945
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by…
7.7
Élevée
CVE-2026-105942
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the…
7.7
Élevée
CVE-2026-105938
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription…
2.3
Faible
CVE-2026-105937
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's…
8.7
Élevée