Improper Certificate Validation Affecting org.apache.pulsar:pulsar-proxy package, versions [,2.7.5)[2.8.0,2.8.4)[2.9.0,2.9.3)[2.10.0,2.10.1)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.05% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-ORGAPACHEPULSAR-3031780
  • published23 Sept 2022
  • disclosed23 Sept 2022
  • creditMichael Marshall

Introduced: 23 Sep 2022

CVE-2022-33681  (opens in a new tab)
CWE-295  (opens in a new tab)

How to fix?

Upgrade org.apache.pulsar:pulsar-proxy to version 2.7.5, 2.8.4, 2.9.3, 2.10.1 or higher.

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation when the authentication data is sent before verifying if the server’s TLS certificate matches the hostname, which means authentication data could be exposed to an attacker. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. Because the client sends authentication data before performing hostname verification, an attacker could gain access to the client’s authentication data.

Workaround:

Users unable to upgrade to the fixed version should rotate vulnerable authentication data, including tokens and passwords.

CVSS Scores

version 3.1