CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification

🗓️ 07 Feb 2024 09:18:19Reported by GoogleType

osv🔗 osv.dev👁 24 Views

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider. Upgrade to versions 2.11.3, 3.0.2, or 3.1.1. Consider updating configured secret. Affected components: Pulsar Broker, Proxy, Websocket Proxy, Function Worker

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to security restrictions bypass	29 Mar 202401:37	–	ibm
BDU FSTEC	The vulnerability of the `saslJaasServerRoleTokenSignerSecretPath` component in the cloud platform for distributed messaging and Apache Pulsar’s streaming communication allows a attacker to forge the SASL role token, thereby compromising the confidentiality and integrity of the protected information.	3 May 202400:00	–	bdu_fstec
Circl	CVE-2023-51437	7 Feb 202411:26	–	circl
CNNVD	Apache Pulsar Security Vulnerability	7 Feb 202400:00	–	cnnvd
CVE	CVE-2023-51437	7 Feb 202409:18	–	cve
Cvelist	CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification	7 Feb 202409:18	–	cvelist
EUVD	EUVD-2024-0609	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability	7 Feb 202412:30	–	github
NVD	CVE-2023-51437	7 Feb 202410:15	–	nvd
OSV	GHSA-C57V-4VG5-CM2X Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability	7 Feb 202412:30	–	osv

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/02/07/1
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51437.json
lists	www.lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-51437

08 Jul 2026 07:59Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.4

EPSS0.00763