CVE-2022-33682

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-33682
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-33682.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-33682
Aliases
Published
2022-09-23T09:25:14Z
Modified
2026-07-08T20:29:05.098899Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack
Details

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.10.0"
                },
                {
                    "last_affected": "2.10.0"
                },
                {
                    "introduced": "2.7"
                },
                {
                    "last_affected": "2.7.4"
                },
                {
                    "introduced": "2.8"
                },
                {
                    "last_affected": "2.8.3"
                },
                {
                    "introduced": "2.9"
                },
                {
                    "last_affected": "2.9.2"
                },
                {
                    "introduced": "2.6 and earlier"
                },
                {
                    "last_affected": "2.6.4"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33682.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-295"
    ]
}
References

Affected packages

Git / github.com/apache/pulsar

Affected ranges

Type
GIT
Repo
https://github.com/apache/pulsar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8eae5b8d572861e49c40d456b1f3cbc5d414afe1
Introduced
89ac98e4af363b09f2fe8e309539b0e35243aaee
Fixed
02ee5616866d4eda8dd94f85d9d9b71c459f248d
Introduced
bdd57b21a66b81aab72c4ec39d516ffd2a769c35
Fixed
dd9a5f1f91651b634600f66c53dcc6ad855fb669
Introduced
2318a180c06c5d885af8cbbbcdae4f2ea8468cc1
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:pulsar:2.10.0:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.5"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "fixed": "2.8.4"
        },
        {
            "introduced": "2.9.0"
        },
        {
            "fixed": "2.9.3"
        },
        {
            "introduced": "2.10.0-NA"
        },
        {
            "last_affected": "2.10.0-NA"
        }
    ]
}

Affected versions

2.*
2.10.0-NA
v1.*
v1.14
v1.15
v1.16
v1.17
v1.18
v2.*
v2.7.0
v2.7.0-candidate-1
v2.7.0-candidate-2
v2.7.1
v2.7.1-candidate-1
v2.7.2
v2.7.2-candidate-1
v2.7.3
v2.7.3-candidate-1
v2.7.3-candidate-2
v2.7.4
v2.7.4-candidate-1
v2.7.4-candidate-2
v2.7.5-candidate-1
v2.7.5-candidate-2
v2.8.0
v2.8.0-candidate-3
v2.8.1
v2.8.1-candidate-1
v2.8.1-candidate-2
v2.8.1-candidate-3
v2.8.2
v2.8.2-candidate-1
v2.8.2-candidate-2
v2.8.3
v2.8.3-candidate-1
v2.8.3-candidate-2
v2.8.3-candidate-3
v2.8.3-candidate-4
v2.9.0
v2.9.0-candidate-4
v2.9.1
v2.9.1-candidate-1
v2.9.1-candidate-2
v2.9.2
v2.9.2-candidate-1
v2.9.2-candidate-2
v2.9.2-candidate-3
v2.9.2-candidate-4

Database specific

vanir_signatures_modified 
"2026-07-08T20:29:05Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-33682.json"
vanir_signatures 
[
    {
        "id": "CVE-2022-33682-12259f2a",
        "digest": {
            "function_hash": "277975139527168023542583758241860614296",
            "length": 2292.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/apache/pulsar/commit/8eae5b8d572861e49c40d456b1f3cbc5d414afe1",
        "deprecated": false,
        "target": {
            "function": "ClientCredentialFlow::authenticate",
            "file": "pulsar-client-cpp/lib/auth/AuthOauth2.cc"
        }
    },
    {
        "id": "CVE-2022-33682-92d1ae86",
        "digest": {
            "line_hashes": [
                "138731027338807742257602544720899196755",
                "74687474208210138331018143514760494178",
                "127537404541661293760255813251277450694",
                "269130058048547313450032167743061572422",
                "160586998600921754464278051758511912165",
                "138731027338807742257602544720899196755",
                "74687474208210138331018143514760494178",
                "307704974728367209802353624848416088758",
                "101532560577043034689871438614523044420",
                "109557709976533886429298576965339903191"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/apache/pulsar/commit/8eae5b8d572861e49c40d456b1f3cbc5d414afe1",
        "deprecated": false,
        "target": {
            "file": "pulsar-client-cpp/lib/auth/AuthOauth2.cc"
        }
    },
    {
        "id": "CVE-2022-33682-df50935f",
        "digest": {
            "function_hash": "251125620373411933348266831728513899338",
            "length": 1666.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/apache/pulsar/commit/8eae5b8d572861e49c40d456b1f3cbc5d414afe1",
        "deprecated": false,
        "target": {
            "function": "ClientCredentialFlow::initialize",
            "file": "pulsar-client-cpp/lib/auth/AuthOauth2.cc"
        }
    }
]