The vulnerability of the `saslJaasServerRoleTokenSignerSecretPath` component in the cloud platform for distributed messaging and Apache Pulsar’s streaming communication allows a attacker to forge the SASL role token, thereby compromising the confidentiality and integrity of the protected information.

Vulnerability in saslJaasServerRoleTokenSignerSecretPath enables forging SASL tokens due to weak data protection.

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to security restrictions bypass	29 Mar 202401:37	–	ibm
Circl	CVE-2023-51437	7 Feb 202411:26	–	circl
CNNVD	Apache Pulsar Security Vulnerability	7 Feb 202400:00	–	cnnvd
CVE	CVE-2023-51437	7 Feb 202409:18	–	cve
Cvelist	CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification	7 Feb 202409:18	–	cvelist
EUVD	EUVD-2024-0609	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability	7 Feb 202412:30	–	github
NVD	CVE-2023-51437	7 Feb 202410:15	–	nvd
OSV	GHSA-C57V-4VG5-CM2X Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability	7 Feb 202412:30	–	osv
Prion	Buffer overflow	7 Feb 202410:15	–	prion

Vulners

Node

apache pulsarRange≤2.10.5

apache pulsarRange2.11.0–2.11.2

apache pulsarRange3.0.0–3.0.1

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/02/07/1
lists	www.lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5
web	www.web.nvd.nist.gov/view/vuln/detail

03 May 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 27.1

CVSS 37.4

EPSS0.00095