Aller au contenu
en Se connecter
6.4 Moyenne

CVE-2024-28098 The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies,…

Description

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Apache Pulsar users should upgrade to at least 2.10.6. 2.11 Apache Pulsar users should upgrade to at least 2.11.4. 3.0 Apache Pulsar users should upgrade to at least 3.0.3. 3.1 Apache Pulsar users should upgrade to at least 3.1.3. 3.2 Apache Pulsar users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Pulsar 3.2 3.2.0 → < 3.2.1 3.2.1
Apache Pulsar 3.1 3.1.0 → < 3.1.3 3.1.3
Apache Pulsar 3.0 3.0.0 → < 3.0.3 3.0.3
Apache Pulsar 2.11 2.11.0 → < 2.11.4 2.11.4
Apache Pulsar 2.7 2.7.1 → < 2.10.6 2.10.6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Pulsar

Les 30 CVE de Apache Pulsar →
CVE-2026-105945 The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by… 7.7 Élevée CVE-2026-105942 When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the… 7.7 Élevée CVE-2026-105938 Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription… 2.3 Faible CVE-2026-105937 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's… 8.7 Élevée
Suivre cette CVE