Lucene search

Veracode Vulnerability DatabaseVERACODE:37316

HistorySep 28, 2022 - 11:59 a.m.

Improper Certificate Validation

2022-09-2811:59:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

7.5%

JSON

Apache Pulsar is vulnerable to improper certificate validation. The vulnerability exists due to man in the middle attacks in intra-cluster connections and geo-replication connections which allows an attacker to take control of a machine between the client and the server.

CPENameOperatorVersion
pulsar proxyeq2.10.0
pulsar proxyle2.7.4
pulsar proxyle2.5.1
pulsar proxyle2.8.3
pulsar proxyle2.9.2
pulsar commoneq2.10.0
pulsar commonle2.7.4
pulsar commonle2.8.3
pulsar commonle2.9.2
pulsareq2.10.0

Name	Operator	Version
pulsar proxy	eq	2.10.0
pulsar proxy	le	2.7.4
pulsar proxy	le	2.5.1
pulsar proxy	le	2.8.3
pulsar proxy	le	2.9.2
pulsar common	eq	2.10.0
pulsar common	le	2.7.4
pulsar common	le	2.8.3
pulsar common	le	2.9.2
pulsar	eq	2.10.0

Rows per page:

1-10 of 261

References

github.com/advisories/GHSA-jvf3-mfxv-jcqr

github.com/apache/pulsar/commit/0348502a20694b58e6e79a467ca3a2142a90800f

github.com/apache/pulsar/pull/15824

lists.apache.org/thread/l0ynfl161qghwfcgbbl8ld9hzbl9t3yx

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

7.5%

JSON

Related for VERACODE:37316