Log in Start free

Vulnerability · Published Sep 23, 2022 · Assigned by apache

CVE-2022-33682Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack

Medium 5.9

In plain English

A medium-severity improper certificate validation in Apache Pulsar from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.7%top 46.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.pulsar:pulsar-broker2.7.5GHSA-jvf3-mfxv-jcqr
Mavenorg.apache.pulsar:pulsar-broker2.8.4GHSA-jvf3-mfxv-jcqr
Mavenorg.apache.pulsar:pulsar-broker2.9.3GHSA-jvf3-mfxv-jcqr
Mavenorg.apache.pulsar:pulsar-broker2.10.1GHSA-jvf3-mfxv-jcqr
Mavenorg.apache.pulsar:pulsar-proxy2.10.1GHSA-jvf3-mfxv-jcqr
Mavenorg.apache.pulsar:pulsar-proxy2.7.5GHSA-jvf3-mfxv-jcqr
Mavenorg.apache.pulsar:pulsar-proxy2.9.3GHSA-jvf3-mfxv-jcqr
Mavenorg.apache.pulsar:pulsar-proxy2.8.4GHSA-jvf3-mfxv-jcqr

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Pulsar 2.10.02.7 – through 2.7.42.8 – through 2.8.32.9 – through 2.9.22.6 and earlier – through 2.6.4

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References