org.apache.pulsar:pulsar-server-distribution (=3.1.0) potentially affected by CVE-2022-34321 via org.apache.pulsar:pulsar-proxy (=3.1.0)

org.apache.pulsar:pulsar-proxy MAVEN version =3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-proxy and may be impacted: - org.apache.pulsar:pulsar-server-distribution =3.1.0 Source cves: CVE-2022-34321 Source advisory:...

org.apache.pulsar:pulsar-server-distribution (>=3.0.0 <=3.0.17) potentially affected by CVE-2022-34321 via org.apache.pulsar:pulsar-proxy (>=3.0.0 <=3.0.17)

org.apache.pulsar:pulsar-proxy MAVEN version =3.0.0, =3.0.0, =3.0.17 Source cves: CVE-2022-34321 Source advisory: OSV:GHSA-C35H-W8HJ-MM55...

CVE-2022-34321 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint

Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections...

CVE-2022-34321

CVE-2022-34321 (Apache Pulsar Proxy) is an Improper Authentication vulnerability affecting Pulsar Proxy statistics at /proxy-stats. Connected docs specify impact: unauthorized access to live-connection stats and the ability to modify logging levels, potentially leaking client IPs and enabling DoS...