Non notée
CVE-2022-33683 Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates,…
Description
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Pulsar | 2.10.0 | Pas de correctif indiqué |
| Apache Pulsar 2.9 | 2.9 → 2.9.2 | Pas de correctif indiqué |
| Apache Pulsar 2.8 | 2.8 → 2.8.3 | Pas de correctif indiqué |
| Apache Pulsar 2.7 | 2.7 → 2.7.4 | Pas de correctif indiqué |
| Apache Pulsar 2.6 | premières → 2.6.4 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Pulsar
Les 30 CVE de Apache Pulsar →
CVE-2026-105945
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by…
7.7
Élevée
CVE-2026-105942
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the…
7.7
Élevée
CVE-2026-105938
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription…
2.3
Faible
CVE-2026-105937
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's…
8.7
Élevée