io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.3) +4 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=2.11.0, <=2.11.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.3 Source cves: CVE-2024-27894 Source advisory: OSV:GHSA-C2X9-VW5H-39VC...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), com.clever-cloud:biscuit-pulsar (>=2.2.2, <=3.2.1) +11 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=2.4.0, <=2.10.5)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.4.0, =2.7.1.5, =2.2.2, =3.1.7, =3.6, =3.6, =0.0.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.0.0, =1.1.0 Source cves: CVE-2024-27894 Source advisory: OSV:GHSA-C2X9-VW5H-39VC...

org.apache.pulsar:pulsar-broker (3.2.0), org.apache.pulsar:pulsar-broker-auth-athenz (3.2.0) +3 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (3.2.0)

org.apache.pulsar:pulsar-functions-worker MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-functions-worker and may be impacted: - org.apache.pulsar:pulsar-broker 3.2.0 -...

com.datastax.oss:pulsar-jms-filters (>=4.0.0, <=4.0.1), io.github.yangl:pulsar-msg-filter-plugin (3.0) +6 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=3.0.0, <=3.0.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.0.0, =4.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 Source cves: CVE-2024-27894 Source advisory: OSV:GHSA-C2X9-VW5H-39VC...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.3) +4 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=2.11.0, <=2.11.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.3 Source cves: CVE-2024-27894 Source advisory: GHSA-C2X9-VW5H-39VC...

com.datastax.oss:pulsar-jms-filters (>=4.0.0, <=4.0.1), io.github.yangl:pulsar-msg-filter-plugin (3.0) +6 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=3.0.0, <=3.0.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.0.0, =4.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 Source cves: CVE-2024-27894 Source advisory: GHSA-C2X9-VW5H-39VC...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.3) +4 more potentially affected by CVE-2024-27135 via org.apache.pulsar:pulsar-functions-worker (>=2.11.0, <=2.11.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.3 Source cves: CVE-2024-27135 Source advisory: OSV:GHSA-XP2R-G8QQ-44HH...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), com.clever-cloud:biscuit-pulsar (>=2.2.2, <=3.2.1) +11 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=2.4.0, <=2.10.5)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.4.0, =2.7.1.5, =2.2.2, =3.1.7, =3.6, =3.6, =0.0.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.0.0, =1.1.0 Source cves: CVE-2024-27317 Source advisory: GHSA-JG2G-4RJG-CMQH...

org.apache.pulsar:pulsar-broker (3.2.0), org.apache.pulsar:pulsar-broker-auth-athenz (3.2.0) +3 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (3.2.0)

org.apache.pulsar:pulsar-functions-worker MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-functions-worker and may be impacted: - org.apache.pulsar:pulsar-broker 3.2.0 -...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.3) +4 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=2.11.0, <=2.11.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.3 Source cves: CVE-2024-27317 Source advisory: GHSA-JG2G-4RJG-CMQH...

com.datastax.oss:pulsar-jms-filters (>=4.0.0, <=4.0.1), io.github.yangl:pulsar-msg-filter-plugin (3.0) +6 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=3.0.0, <=3.0.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.0.0, =4.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 Source cves: CVE-2024-27317 Source advisory: GHSA-JG2G-4RJG-CMQH...

org.apache.pulsar:pulsar-broker (>=3.1.0, <=3.1.2), org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0, <=3.1.2) +3 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=3.1.0, <=3.1.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 Source cves: CVE-2024-27317 Source advisory: GHSA-JG2G-4RJG-CMQH...

GHSA-C2X9-VW5H-39VC Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

com.datastax.oss:pulsar-jms-filters (>=4.0.0, <=4.0.1), io.github.yangl:pulsar-msg-filter-plugin (3.0) +6 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=3.0.0, <=3.0.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.0.0, =4.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 Source cves: CVE-2024-27317 Source advisory: OSV:GHSA-JG2G-4RJG-CMQH...

CVE-2024-27135

A vulnerability in Apache Pulsar allows a malicious authenticated user to perform remote arbitrary code execution on Pulsar's function worker. A successful attack impacts the data integrity and confidentiality, as well as system availability. Pulsar broker is also susceptible to this attack when...

CVE-2024-27894

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

CVE-2024-27317

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in th...

Directory traversal

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in th...

Design/Logic Flaw

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

org.apache.pulsar:pulsar-broker (>=3.1.0, <=3.1.2), org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0, <=3.1.2) +3 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=3.1.0, <=3.1.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 Source cves: CVE-2024-27894 Source advisory: MEND:CVE-2024-27894...