CVE-2022-33682

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle...

CVE-2022-33681

CVE-2022-33681 describes a vulnerability in the Apache Pulsar Java Client and Pulsar Proxy where delayed TLS hostname verification allows a MITM to capture authentication data. Affected software (from the provided docs) includes Apache Pulsar Java Client versions: 2.7.0–2.7.4; 2.8.0–2.8.3; 2.9.0–...

CVE-2022-33681

Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication...

CVE-2022-33681 Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM

Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication...

CVE-2022-33681 Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM

Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication...

PT-2022-21797 · Apache · Apache Pulsar Java Client

Name of the Vulnerable Software and Affected Versions: Apache Pulsar Java Client versions 2.6.4 and earlier Apache Pulsar Java Client versions 2.7.0 through 2.7.4 Apache Pulsar Java Client versions 2.8.0 through 2.8.3 Apache Pulsar Java Client versions 2.9.0 through 2.9.2 Apache Pulsar Java Clien...

CVE-2022-33681: Improper Certificate Validation

Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication...

Apache Pulsar 信任管理问题漏洞

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenancy, persistent storage, multi-machine room cross-region data replication...

com.opensearchserver:oss-java-client (1.0.0), com.opensearchserver:oss-utils (1.0.0) +63 more potentially affected by CVE-2021-3859 via io.undertow:undertow-core (1.1.2.final)

io.undertow:undertow-core MAVEN version 1.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-java-client 1.0.0 - com.opensearchserver:oss-utils 1.0.0 -...

com.opensearchserver:oss-java-client (1.0.0), com.opensearchserver:oss-utils (1.0.0) +63 more potentially affected by CVE-2021-3690 via io.undertow:undertow-core (1.1.2.final)

io.undertow:undertow-core MAVEN version 1.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-java-client 1.0.0 - com.opensearchserver:oss-utils 1.0.0 -...

org.cometd.java:cometd-java-client (2.4.0.rc3), org.cometd.java:cometd-java-examples (2.4.0.rc3) +59 more potentially affected by CVE-2022-2047 via org.eclipse.jetty:jetty-http (7.6.0.rc5)

org.eclipse.jetty:jetty-http MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-http and may be impacted: - org.cometd.java:cometd-java-client 2.4.0.rc3 - org.cometd.java:cometd-java-examples 2.4.0.rc3 -...

org.cometd.java:cometd-examples-java (1.1.2), org.cometd.java:cometd-java-client (>=1.1.2, <=2.0.0) +51 more potentially affected by CVE-2022-2047 via org.eclipse.jetty:jetty-http (7.1.5.v20100705)

org.eclipse.jetty:jetty-http MAVEN version 7.1.5.v20100705 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-http and may be impacted: - org.cometd.java:cometd-examples-java 1.1.2 - org.cometd.java:cometd-java-client =1.1.2, =1.1....

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to spoofing due to Eclipse Paho (CVE-2019-11777)

Summary There is a vulnerability in the Eclipse Paho library used by IBM WebSphere Application Server Liberty with the rtcomm-1.0 or rtcommGateway-1.0 feature enabled. This has been addressed. Vulnerability Details CVEID: CVE-2019-11777 DESCRIPTION: Eclipse Paho Java client could allow a remote...

com.opensearchserver:oss-java-client (1.0.0), com.opensearchserver:oss-utils (1.0.0) +63 more potentially affected by CVE-2021-3597 via io.undertow:undertow-core (1.1.2.final)

io.undertow:undertow-core MAVEN version 1.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-java-client 1.0.0 - com.opensearchserver:oss-utils 1.0.0 -...

com.opensearchserver:oss-java-client (1.0.0), com.opensearchserver:oss-utils (1.0.0) +63 more potentially affected by CVE-2020-1745 via io.undertow:undertow-core (1.1.2.final)

io.undertow:undertow-core MAVEN version 1.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-java-client 1.0.0 - com.opensearchserver:oss-utils 1.0.0 -...

new packages: mariadb-java-client

An update is available for mariadb-java-client. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rock...

com.amazon.aes.webservices.client:ec2-java-client (20080327), com.cybersource:cybersource-sdk-java (>=6.2.0, <=6.2.1) +83 more potentially affected by CVE-2015-0227 via wss4j:wss4j (>=1.5.0, <=1.5.1)

wss4j:wss4j MAVEN version =1.5.0, =6.2.0, =1.0.12, =9.00.2110.07.220316, =0.0.9, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.3.0 - com.github.rapidark:rapid-ark-pretty 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo-keeper 0.3.0 -...

com.amazon.aes.webservices.client:ec2-java-client (20080327), com.cybersource:cybersource-sdk-java (>=6.2.0, <=6.2.1) +83 more potentially affected by CVE-2015-0227 via wss4j:wss4j (>=1.5.0, <=1.5.1)

wss4j:wss4j MAVEN version =1.5.0, =6.2.0, =1.0.12, =9.00.2110.07.220316, =0.0.9, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.3.0 - com.github.rapidark:rapid-ark-pretty 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo 0.3.0 - com.github.rapidark:rapid-ark-pretty-demo-keeper 0.3.0 -...

Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks...

com.opensearchserver:oss-java-client (1.0.0), com.opensearchserver:oss-utils (1.0.0) +63 more potentially affected by CVE-2018-14642 via io.undertow:undertow-core (1.1.2.final)

io.undertow:undertow-core MAVEN version 1.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-java-client 1.0.0 - com.opensearchserver:oss-utils 1.0.0 -...