CVE-2023-31007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-31007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-31007
Aliases
Published
2023-07-12T10:15:10.013Z
Modified
2026-04-12T03:51:13.869673Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.

This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0.

2.9 Pulsar Broker users should upgrade to at least 2.9.5. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected. Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.

References

Affected packages

Git / github.com/apache/pulsar

Affected ranges

Type
GIT
Repo
https://github.com/apache/pulsar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7337470f33586aa639854266efe95c2fa32f48db
Introduced
2318a180c06c5d885af8cbbbcdae4f2ea8468cc1
Last affected
b69f4efa6058c3f51885a61a2b3acb46f8b730f4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
97ee1a114aa1e5df05d86a9dd47f7fe7a2194211
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
70d7303f8f2aa149aac1b6b867bbc25d9b0f43aa
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
97ee1a114aa1e5df05d86a9dd47f7fe7a2194211
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.9.5"
        },
        {
            "introduced": "2.10.0"
        },
        {
            "last_affected": "2.10.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.11.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.11.0-candidate_1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.11.0-candidate_5"
        }
    ]
}

Affected versions

v1.*
v1.14
v1.15
v1.16
v1.17
v1.18
v2.*
v2.10.0
v2.10.0-candidate-5
v2.10.1
v2.10.1-candidate-1
v2.10.2
v2.10.2-candidate-1
v2.10.2-candidate-2
v2.10.2-candidate-3
v2.10.3
v2.10.3-candidate-1
v2.11.0
v2.11.0-candidate-1
v2.11.0-candidate-2
v2.11.0-candidate-3
v2.11.0-candidate-4
v2.11.0-candidate-5
v2.9.0
v2.9.0-candidate-1
v2.9.0-candidate-2
v2.9.0-candidate-3
v2.9.0-candidate-4
v2.9.1
v2.9.1-candidate-1
v2.9.1-candidate-2
v2.9.2
v2.9.2-candidate-1
v2.9.2-candidate-2
v2.9.2-candidate-3
v2.9.2-candidate-4
v2.9.3
v2.9.3-candidate-1
v2.9.3-candidate-2
v2.9.5-candidate-1
v2.9.5-candidate-2
vx.*
vx.y.z.m

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-31007.json"
vanir_signatures 
[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "302029677739701733734435428009241703608",
                "163062317825201143539672300461047643770",
                "141495717033435555136578412888047774729",
                "81770924331702341207028235559324462337",
                "45489181914701388124701949382794878378",
                "54681320331571751180311390082043951912",
                "311314426916426004915570925173150878911",
                "55294833529814651088286299577086591027"
            ]
        },
        "id": "CVE-2023-31007-eac6697a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/apache/pulsar/commit/7337470f33586aa639854266efe95c2fa32f48db",
        "target": {
            "file": "pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java"
        }
    },
    {
        "digest": {
            "length": 1444.0,
            "function_hash": "282954886638626021980607813782086911541"
        },
        "id": "CVE-2023-31007-fafa03c4",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/apache/pulsar/commit/7337470f33586aa639854266efe95c2fa32f48db",
        "target": {
            "function": "validateSuperUserAccess",
            "file": "pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java"
        }
    }
]
vanir_signatures_modified 
"2026-04-12T03:51:13Z"