CVE-2023-51437

🗓️ 07 Feb 2024 10:15:08Reported by [email protected]Type

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider. Upgrade to versions 2.11.3, 3.0.2, or 3.1.1. Consider updating configured secret in 'saslJaasServerRoleTokenSignerSecretPath' file

Reporter	Title	Published	Views	Family All 16
IBM Security Bulletins	Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to security restrictions bypass	29 Mar 202401:37	–	ibm
BDU FSTEC	The vulnerability of the `saslJaasServerRoleTokenSignerSecretPath` component in the cloud platform for distributed messaging and Apache Pulsar’s streaming communication allows a attacker to forge the SASL role token, thereby compromising the confidentiality and integrity of the protected information.	3 May 202400:00	–	bdu_fstec
Circl	CVE-2023-51437	7 Feb 202411:26	–	circl
CNNVD	Apache Pulsar Security Vulnerability	7 Feb 202400:00	–	cnnvd
CVE	CVE-2023-51437	7 Feb 202409:18	–	cve
Cvelist	CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification	7 Feb 202409:18	–	cvelist
EUVD	EUVD-2024-0609	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability	7 Feb 202412:30	–	github
OSV	GHSA-C57V-4VG5-CM2X Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability	7 Feb 202412:30	–	osv
Prion	Buffer overflow	7 Feb 202410:15	–	prion