pandiocli (>=1.0.5, <=1.0.9), pandioml (>=1.0.2, <=1.0.5) +2 more potentially affected by CVE-2022-33684 via pulsar-client (>=2.1.0, <=2.6.0)

pulsar-client PYPI version =2.1.0, =1.0.5, =1.0.2, =0.0.0, =0.0.1, =0.8.1 Source cves: CVE-2022-33684 Source advisory: OSV:PYSEC-2026-901...

c8-source-c8collection (>=0.0.2, <=0.0.10), macrometa-source-collection (>=0.0.11, <=1.0.6a2) potentially affected by CVE-2022-33684 via pulsar-client (2.10.1)

pulsar-client PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on pulsar-client and may be impacted: - c8-source-c8collection =0.0.2, =0.0.11, =1.0.6a2 Source cves: CVE-2022-33684 Source advisory: OSV:PYSEC-2026-901...

Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.1) +7 more potentially affected by CVE-2023-37544 via org.apache.pulsar:pulsar-websocket (>=2.11.0, <=2.11.1)

org.apache.pulsar:pulsar-websocket MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.1 Source cves: CVE-2023-37544 Source advisory: OSV:GHSA-83Q5-WHQP-R8JR...

com.datastax.oss:pulsar-jms-filters (>=4.0.0, <=4.0.1), io.streamnative.oss:pulsar-jms-filters (4.0.5) +8 more potentially affected by CVE-2023-37544 via org.apache.pulsar:pulsar-websocket (3.0.0)

org.apache.pulsar:pulsar-websocket MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-websocket and may be impacted: - com.datastax.oss:pulsar-jms-filters =4.0.0, =4.0.1 - io.streamnative.oss:pulsar-jms-filters...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.1) +7 more potentially affected by CVE-2023-37544 via org.apache.pulsar:pulsar-websocket (>=2.11.0, <=2.11.1)

org.apache.pulsar:pulsar-websocket MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.1 Source cves: CVE-2023-37544 Source advisory: MEND:CVE-2023-37544...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), com.clever-cloud:biscuit-pulsar (>=2.2.2, <=3.2.1) +13 more potentially affected by CVE-2023-37579 via org.apache.pulsar:pulsar-functions-worker (>=2.0.0-rc1-incubating, <=2.10.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.0.0-rc1-incubating, =2.7.1.5, =2.2.2, =3.1.7, =3.6, =3.6, =0.0.1, =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.4.0, =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.1.0-incubating, =2.0.0-rc1-incubating, =1.0.0,...

Pulsar C++ Client Python Client MITM

The vulnerability of the Pulsar C++ Client and Pulsar Python Client components of the cloud platform for distributed messaging and Apache Pulsar streaming communication is related to errors in the certificate validation process during TLS authentication. Exploiting this vulnerability could allow ...

pandiocli (>=1.0.5, <=1.0.9), pandioml (>=1.0.2, <=1.0.5) +2 more potentially affected by CVE-2022-33684 via pulsar-client (>=2.1.0, <=2.6.0)

pulsar-client PYPI version =2.1.0, =1.0.5, =1.0.2, =0.0.0, =0.0.1, =0.8.1 Source cves: CVE-2022-33684 Source advisory: GHSA-5R3H-C3R7-9W4H...

c8-source-c8collection (>=0.0.2, <=0.0.10), macrometa-source-collection (>=0.0.11, <=1.0.6a2) potentially affected by CVE-2022-33684 via pulsar-client (2.10.1)

pulsar-client PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on pulsar-client and may be impacted: - c8-source-c8collection =0.0.2, =0.0.11, =1.0.6a2 Source cves: CVE-2022-33684 Source advisory: GHSA-5R3H-C3R7-9W4H...

pandiocli (>=1.0.5, <=1.0.9), pandioml (>=1.0.2, <=1.0.5) +2 more potentially affected by CVE-2022-33684 via pulsar-client (>=2.1.0, <=2.6.0)

pulsar-client PYPI version =2.1.0, =1.0.5, =1.0.2, =0.0.0, =0.0.1, =0.8.1 Source cves: CVE-2022-33684 Source advisory: OSV:GHSA-5R3H-C3R7-9W4H...

c8-source-c8collection (>=0.0.2, <=0.0.10), macrometa-source-collection (>=0.0.11, <=1.0.6a2) potentially affected by CVE-2022-33684 via pulsar-client (2.10.1)

pulsar-client PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on pulsar-client and may be impacted: - c8-source-c8collection =0.0.2, =0.0.11, =1.0.6a2 Source cves: CVE-2022-33684 Source advisory: OSV:GHSA-5R3H-C3R7-9W4H...

c8-source-c8collection (>=0.0.2, <=0.0.10), macrometa-source-collection (>=0.0.11, <=1.0.6a2) potentially affected by CVE-2022-33684 via pulsar-client (2.10.1)

pulsar-client PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on pulsar-client and may be impacted: - c8-source-c8collection =0.0.2, =0.0.11, =1.0.6a2 Source cves: CVE-2022-33684 Source advisory: MEND:CVE-2022-33684...

pandiocli (>=1.0.5, <=1.0.9), pandioml (>=1.0.2, <=1.0.5) +2 more potentially affected by CVE-2022-33684 via pulsar-client (>=2.1.0, <=2.6.0)

pulsar-client PYPI version =2.1.0, =1.0.5, =1.0.2, =0.0.0, =0.0.1, =0.8.1 Source cves: CVE-2022-33684 Source advisory: MEND:CVE-2022-33684...

PT-2022-5873

Name of the Vulnerable Software and Affected Versions Apache Pulsar C++ Client versions 2.7.0 through 2.7.4 Apache Pulsar C++ Client versions 2.8.0 through 2.8.3 Apache Pulsar C++ Client versions 2.9.0 through 2.9.2 Apache Pulsar C++ Client versions 2.10.0 through 2.10.1 Apache Pulsar C++ Client...

com.github.thinker0.heron:heron-common (>=1.0.0, <=1.0.7), com.github.thinker0.heron:heron-kafka-client (>=1.0.0, <=1.0.7) +1 more potentially affected by CVE-2021-42010 via org.apache.heron:heron-api (>=0.20.1-incubating, <=0.20.4-incubating)

org.apache.heron:heron-api MAVEN version =0.20.1-incubating, =1.0.0, =1.0.0, =1.0.3, =1.0.7 Source cves: CVE-2021-42010 Source advisory: GHSA-95W5-Q9VP-5VRM...

com.github.thinker0.heron:heron-common (>=1.0.0, <=1.0.7), com.github.thinker0.heron:heron-kafka-client (>=1.0.0, <=1.0.7) +1 more potentially affected by CVE-2021-42010 via org.apache.heron:heron-api (>=0.20.1-incubating, <=0.20.4-incubating)

org.apache.heron:heron-api MAVEN version =0.20.1-incubating, =1.0.0, =1.0.0, =1.0.3, =1.0.7 Source cves: CVE-2021-42010 Source advisory: OSV:GHSA-95W5-Q9VP-5VRM...

com.github.thinker0.heron:heron-common (>=1.0.0, <=1.0.7), com.github.thinker0.heron:heron-kafka-client (>=1.0.0, <=1.0.7) +1 more potentially affected by CVE-2021-42010 via org.apache.heron:heron-api (>=0.20.1-incubating, <=0.20.4-incubating)

org.apache.heron:heron-api MAVEN version =0.20.1-incubating, =1.0.0, =1.0.0, =1.0.3, =1.0.7 Source cves: CVE-2021-42010 Source advisory: MEND:CVE-2021-42010...

club.callmee:spring-boot-pulsar-starter-client (>=2.10.0-11-1, <=2.10.0-11-3), com.datastax.astra:astra-sdk (>=0.3.1, <=0.3.3) +34 more potentially affected by CVE-2022-33681 via org.apache.pulsar:pulsar-client (2.10.0)

org.apache.pulsar:pulsar-client MAVEN version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-client and may be impacted: - club.callmee:spring-boot-pulsar-starter-client =2.10.0-11-1, =0.3.1, =0.3.1, =0.3.1, =1.0.5,...

com.chatroulette:neutron-circe_2.12 (0.0.2), com.chatroulette:neutron-circe_2.13 (>=0.0.2, <=0.0.9) +150 more potentially affected by CVE-2022-33681 via org.apache.pulsar:pulsar-client (>=2.0.0-rc1-incubating, <=2.7.4)

org.apache.pulsar:pulsar-client MAVEN version =2.0.0-rc1-incubating, =0.0.2, =0.0.1, =0.0.1, =1.2.1, =1.0.0.m1, =1.0.0.m1, =1.0.3, =2.4.0-m7, =2.4.0-m10 and more Source cves: CVE-2022-33681 Source advisory: GHSA-C5FP-X2H5-VJV7...