Aller au contenu
en Se connecter
0.0 Non notée

CVE-2023-31007 Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay…

Description

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false. This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0. 2.9 Pulsar Broker users should upgrade to at least 2.9.5. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected. Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Pulsar 2.11.0 Pas de correctif indiqué
Apache Pulsar 2.10 2.10.0 → 2.10.3 Pas de correctif indiqué
Apache Pulsar 2.9 premières → < 2.9.5 2.9.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Pulsar

Les 30 CVE de Apache Pulsar →
CVE-2026-105945 The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by… 7.7 Élevée CVE-2026-105942 When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the… 7.7 Élevée CVE-2026-105938 Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription… 2.3 Faible CVE-2026-105937 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's… 8.7 Élevée
Suivre cette CVE