Vulnerability · Published May 26, 2021 · Assigned by apache
CVE-2021-22160Authentication with JWT allows use of “none”-algorithm
Critical 9.8
In plain English
A critical-severity security flaw in Apache Pulsar from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 52.9% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)52.9%top 1.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.pulsar:pulsar | 2.7.2 | GHSA-3cv4-xxv7-934q |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Pulsar | Apache Pulsar – before 2.7.1 |
References
- https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E x_refsource_MISC
- [pulsar-dev] 20210527 Cutting 2.6.4 release to address CVE-2021-22160 mailing-list, x_refsource_MLIST
- [pulsar-dev] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of "none"-algorithm mailing-list, x_refsource_MLIST
- [pulsar-users] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of "none"-algorithm mailing-list, x_refsource_MLIST
- [pulsar-dev] 20210527 Re: Cutting 2.6.4 release to address CVE-2021-22160 mailing-list, x_refsource_MLIST
- Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of “none”-algorithm mailing-list, x_refsource_MLIST
- [pulsar-dev] 20210531 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions mailing-list, x_refsource_MLIST
- [pulsar-dev] 20210604 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions mailing-list, x_refsource_MLIST