GitHub Advisoryadvisory · Maven

GHSA-3cv4-xxv7-934q Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow

CRITICAL Published 2021-06-01 Modified 2022-06-06 Official page ↗
Aliases
CVE-2021-22160
Ecosystem
Maven
Packages
org.apache.pulsar:pulsar
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347
Reviewed
2021-06-01

Affected packages

• Maven org.apache.pulsar:pulsar: < 2.7.2 → fixed in 2.7.2

Description

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).

Related

Alias · CVE (1)

  • CVE-2021-22160 If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References