Apache Pulsar Brokers and Proxies vulnerable to Improper Certificate Validation

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middl...

com.clever-cloud:biscuit-pulsar (=3.2.1), com.github.shoothzj:test-pulsar (>=3.1.12 <=3.1.15) +6 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (=2.10.0)

org.apache.pulsar:pulsar-broker MAVEN version =2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-broker and may be impacted: - com.clever-cloud:biscuit-pulsar =3.2.1 - com.github.shoothzj:test-pulsar =3.1.12, =0.0.1, =1.0....

com.clever-cloud:biscuit-pulsar (>=2.2.2 <=2.3.0), org.apache.pulsar:pulsar-broker-auth-athenz (>=2.8.0 <=2.8.3) +3 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-broker (>=2.8.0 <=2.8.3)

org.apache.pulsar:pulsar-broker MAVEN version =2.8.0, =2.2.2, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.3 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

org.apache.pulsar:pulsar-server-distribution (>=2.8.0 <=2.8.3) potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-proxy (>=2.8.0 <=2.8.3)

org.apache.pulsar:pulsar-proxy MAVEN version =2.8.0, =2.8.0, =2.8.3 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

org.apache.pulsar:distribution (>=2.0.0-rc1-incubating <=2.0.1-incubating), org.apache.pulsar:pulsar-docker-image (>=2.0.0-rc1-incubating <=2.7.4) +1 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-proxy (>=2.0.0-rc1-incubating <=2.7.4)

org.apache.pulsar:pulsar-proxy MAVEN version =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.1.0-incubating, =2.11.4 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

org.apache.pulsar:pulsar-server-distribution (=2.10.0) potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-proxy (=2.10.0)

org.apache.pulsar:pulsar-proxy MAVEN version =2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-proxy and may be impacted: - org.apache.pulsar:pulsar-server-distribution =2.10.0 Source cves: CVE-2022-33682 Source advisory:...

GHSA-JVF3-MFXV-JCQR Apache Pulsar Broker, Proxy, and WebSocket Proxy vulnerable to Improper Certificate Validation

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5 <=2.7.1.6), com.clever-cloud:biscuit-pulsar (=3.2.1) +11 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (>=1.19.0-incubating <=2.7.4)

org.apache.pulsar:pulsar-broker MAVEN version =1.19.0-incubating, =2.7.1.5, =3.1.12, =3.6, =3.6, =0.0.1, =2.0.0-rc1-incubating, =1.19.0-incubating, =2.4.0, =2.0.0-rc1-incubating, =2.1.0-incubating, =1.19.0-incubating, =1.0.0, =1.1.0 Source cves: CVE-2022-33683 Source advisory:...

org.apache.pulsar:pulsar-server-distribution (>=2.8.0 <=2.8.3) potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-proxy (>=2.8.0 <=2.8.3)

org.apache.pulsar:pulsar-proxy MAVEN version =2.8.0, =2.8.0, =2.8.3 Source cves: CVE-2022-33683 Source advisory: OSV:GHSA-J3QW-G67Q-7M64...

GHSA-J3QW-G67Q-7M64 Apache Pulsar Brokers and Proxies vulnerable to Improper Certificate Validation

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middl...

com.clever-cloud:biscuit-pulsar (>=2.3.2 <=3.2.0), com.github.shoothzj:test-pulsar (>=3.1.7 <=3.1.11) +4 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (>=2.9.0 <=2.9.2)

org.apache.pulsar:pulsar-broker MAVEN version =2.9.0, =2.3.2, =3.1.7, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.2 Source cves: CVE-2022-33683 Source advisory: OSV:GHSA-J3QW-G67Q-7M64...

com.clever-cloud:biscuit-pulsar (=3.2.1), com.github.shoothzj:test-pulsar (>=3.1.12 <=3.1.15) +6 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-broker (=2.10.0)

org.apache.pulsar:pulsar-broker MAVEN version =2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-broker and may be impacted: - com.clever-cloud:biscuit-pulsar =3.2.1 - com.github.shoothzj:test-pulsar =3.1.12, =0.0.1, =1.0....

com.clever-cloud:biscuit-pulsar (>=2.3.2 <=3.2.0), com.github.shoothzj:test-pulsar (>=3.1.7 <=3.1.11) +4 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-broker (>=2.9.0 <=2.9.2)

org.apache.pulsar:pulsar-broker MAVEN version =2.9.0, =2.3.2, =3.1.7, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.2 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5 <=2.7.1.6), com.clever-cloud:biscuit-pulsar (=3.2.1) +11 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-broker (>=1.19.0-incubating <=2.7.4)

org.apache.pulsar:pulsar-broker MAVEN version =1.19.0-incubating, =2.7.1.5, =3.1.12, =3.6, =3.6, =0.0.1, =2.0.0-rc1-incubating, =1.19.0-incubating, =2.4.0, =2.0.0-rc1-incubating, =2.1.0-incubating, =1.19.0-incubating, =1.0.0, =1.1.0 Source cves: CVE-2022-33682 Source advisory:...

org.apache.pulsar:pulsar-server-distribution (>=2.9.0 <=2.9.2) potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-proxy (>=2.9.0 <=2.9.2)

org.apache.pulsar:pulsar-proxy MAVEN version =2.9.0, =2.9.0, =2.9.2 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

com.clever-cloud:biscuit-pulsar (>=2.2.2 <=2.3.0), org.apache.pulsar:pulsar-broker-auth-athenz (>=2.8.0 <=2.8.3) +3 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (>=2.8.0 <=2.8.3)

org.apache.pulsar:pulsar-broker MAVEN version =2.8.0, =2.2.2, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =2.8.3 Source cves: CVE-2022-33683 Source advisory: OSV:GHSA-J3QW-G67Q-7M64...

org.apache.pulsar:pulsar-server-distribution (=2.10.0) potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-proxy (=2.10.0)

org.apache.pulsar:pulsar-proxy MAVEN version =2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-proxy and may be impacted: - org.apache.pulsar:pulsar-server-distribution =2.10.0 Source cves: CVE-2022-33683 Source advisory:...

org.apache.pulsar:pulsar-server-distribution (>=2.9.0 <=2.9.2) potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-proxy (>=2.9.0 <=2.9.2)

org.apache.pulsar:pulsar-proxy MAVEN version =2.9.0, =2.9.0, =2.9.2 Source cves: CVE-2022-33683 Source advisory: OSV:GHSA-J3QW-G67Q-7M64...

org.apache.pulsar:distribution (>=2.0.0-rc1-incubating <=2.0.1-incubating), org.apache.pulsar:pulsar-docker-image (>=2.0.0-rc1-incubating <=2.7.4) +1 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-proxy (>=2.0.0-rc1-incubating <=2.7.4)

org.apache.pulsar:pulsar-proxy MAVEN version =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.1.0-incubating, =2.11.4 Source cves: CVE-2022-33683 Source advisory: OSV:GHSA-J3QW-G67Q-7M64...

club.callmee:spring-boot-pulsar-starter-client (>=2.10.0-11-1 <=2.10.0-11-3), com.datastax.astra:astra-sdk (>=0.3.1 <=0.3.3) +34 more potentially affected by CVE-2022-33681 via org.apache.pulsar:pulsar-client (=2.10.0)

org.apache.pulsar:pulsar-client MAVEN version =2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-client and may be impacted: - club.callmee:spring-boot-pulsar-starter-client =2.10.0-11-1, =0.3.1, =0.3.1, =0.3.1, =1.0.5,...