Improper Certificate Validation Affecting org.apache.pulsar:pulsar-client-api package, versions [,2.7.5) [2.8.0,2.8.4) [2.9.0,2.9.3) [2.10.0,2.10.1)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEPULSAR-3031781
- published 23 Sep 2022
- disclosed 23 Sep 2022
- credit Michael Marshall
Introduced: 23 Sep 2022
CVE-2022-33681 Open this link in a new tabHow to fix?
Upgrade org.apache.pulsar:pulsar-client-api
to version 2.7.5, 2.8.4, 2.9.3, 2.10.1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Certificate Validation when the authentication data is sent before verifying if the server’s TLS certificate matches the hostname, which means authentication data could be exposed to an attacker. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. Because the client sends authentication data before performing hostname verification, an attacker could gain access to the client’s authentication data.
Workaround:
Users unable to upgrade to the fixed version should rotate vulnerable authentication data, including tokens and passwords.