Improper Certificate Validation Affecting org.apache.pulsar:pulsar-proxy package, versions [,2.7.5) [2.8.0,2.8.4) [2.9.0,2.9.3) [2.10.0,2.10.1)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEPULSAR-3031799
- published 23 Sep 2022
- disclosed 23 Sep 2022
- credit Michael Marshall
Introduced: 23 Sep 2022
CVE-2022-33683 Open this link in a new tabHow to fix?
Upgrade org.apache.pulsar:pulsar-proxy to version 2.7.5, 2.8.4, 2.9.3, 2.10.1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Certificate Validation due to Apache Pulsar Brokers and Proxies creating an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients.An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack.
Mitigation:
Any users running affected versions of the Pulsar Broker or Pulsar Proxy should rotate static authentication data vulnerable to man in the middle attacks used by these applications, including tokens and passwords.In addition to upgrading, it is also necessary to enable hostname verification to prevent man in the middle attacks.