GHSA-83q5-whqp-r8jr

Source

https://github.com/advisories/GHSA-83q5-whqp-r8jr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-83q5-whqp-r8jr

Aliases

CVE-2023-37544

Published

2023-12-20T09:30:26Z

Modified

2024-02-16T08:23:30.318878Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache Pulsar WebSocket Proxy contains an Improper Authentication vulnerability

Details

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.

This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8., from 2.9.0 through 2.9., from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.

The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5. 2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2. 3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1. 3.1 Pulsar WebSocket Proxy users are unaffected. Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.

Database specific

{
    "nvd_published_at": "2023-12-20T09:15:07Z",
    "cwe_ids": [
        "CWE-287"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-20T20:32:13Z"
}

References

Affected packages

Maven / org.apache.pulsar:pulsar-websocket

Package

Name: org.apache.pulsar:pulsar-websocket; View open source insights on deps.dev
Purl: pkg:maven/org.apache.pulsar/pulsar-websocket

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.10.5

Affected versions

1.*

1.19.0-incubating

1.20.0-incubating

1.21.0-incubating

1.22.0-incubating

1.22.1-incubating

2.*

2.0.0-rc1-incubating

2.0.1-incubating

2.1.0-incubating

2.1.1-incubating

2.2.0

2.2.1

2.3.0

2.3.1

2.3.2

2.4.0

2.4.1

2.4.2

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.7.0

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.8.0

2.8.1

2.8.2

2.8.3

2.8.4

2.9.0

2.9.1

2.9.2

2.9.3

2.9.4

2.9.5

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

Maven / org.apache.pulsar:pulsar-websocket

Package

Name: org.apache.pulsar:pulsar-websocket; View open source insights on deps.dev
Purl: pkg:maven/org.apache.pulsar/pulsar-websocket

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.11.0

Fixed

2.11.2

Affected versions

2.*

2.11.0

2.11.1

Maven / org.apache.pulsar:pulsar-websocket

Package

Name: org.apache.pulsar:pulsar-websocket; View open source insights on deps.dev
Purl: pkg:maven/org.apache.pulsar/pulsar-websocket

GHSA-83q5-whqp-r8jr

Affected packages

Maven / org.apache.pulsar:pulsar-websocket

Package

Affected ranges

Affected versions

1.*

2.*

Maven / org.apache.pulsar:pulsar-websocket

Package

Affected ranges

Affected versions

2.*

Maven / org.apache.pulsar:pulsar-websocket

Package

Affected ranges

Affected versions

3.*