Improper Certificate Validation Affecting org.apache.pulsar:pulsar-client-api package, versions [,2.7.5) [2.8.0,2.8.4) [2.9.0,2.9.3) [2.10.0,2.10.1)


0.0
medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High

    Threat Intelligence

    EPSS 0.07% (27th percentile)
Expand this section
NVD
5.9 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGAPACHEPULSAR-3031781
  • published 23 Sep 2022
  • disclosed 23 Sep 2022
  • credit Michael Marshall

How to fix?

Upgrade org.apache.pulsar:pulsar-client-api to version 2.7.5, 2.8.4, 2.9.3, 2.10.1 or higher.

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation when the authentication data is sent before verifying if the server’s TLS certificate matches the hostname, which means authentication data could be exposed to an attacker. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. Because the client sends authentication data before performing hostname verification, an attacker could gain access to the client’s authentication data.

Workaround:

Users unable to upgrade to the fixed version should rotate vulnerable authentication data, including tokens and passwords.