CVE-2021-22160: Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow
Summary
CVE-2021-22160: Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow. Affects org.apache.pulsar:pulsar versions < 2.7.2. Fixed in 2.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Pulsar is an open-source distributed pub-sub messaging system that is designed for high-performance, durable messaging. It provides features such as scalability, fault tolerance, and multi-tenancy. Pulsar uses JSON Web Tokens (JWT) for client authentication, allowing users to connect to Pulsar instances securely. However, a vulnerability in the token verification process allows an attacker to bypass authentication and connect as any user, including administrators.
Vulnerability Detail
The vulnerability (CVE-2021-22160) in Apache Pulsar arises when the system is configured to authenticate clients using tokens based on JSON Web Tokens (JWT). If the presented token has its algorithm set to "none", the signature of the token is not properly validated. This oversight enables an attacker to connect to Pulsar instances as any user, including administrators. The impact of this vulnerability is severe, as it grants unauthorized access to sensitive resources and allows malicious actors to perform unauthorized actions within the system.
How To Fix
Minimum fixed version
2.7.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify the Pulsar configuration to disallow tokens with the algorithm set to "none". This can be achieved by updating the configuration file to reject tokens that use the "none" algorithm. Here is an example of how to modify the configuration file:
# Disable tokens with 'none' algorithm
tokenAuthenticator: org.apache.pulsar.client.impl.auth.AuthenticationToken
authenticationParameters: {
"tokenPublicKey": "<public-key>",
"tokenAlgorithm": "RS256"
}
Conclusion
The vulnerability in Apache Pulsar allows attackers to bypass authentication and gain unauthorized access to sensitive resources. It is crucial to upgrade to the latest version of Apache Pulsar (2.7.2 or later) to mitigate this vulnerability. Additionally, users can apply the temporary workaround of disallowing tokens with the algorithm set to "none". For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.pulsar:pulsar →
FAQ
Apache Pulsar is an open-source distributed pub-sub messaging system that provides high-performance, durable messaging with features like scalability, fault tolerance, and multi-tenancy.
The vulnerability allows an attacker to bypass authentication and connect to Apache Pulsar instances as any user, including administrators. This grants unauthorized access to sensitive resources and allows malicious actions within the system.
To fix this vulnerability, upgrade Apache Pulsar to version 2.7.2 or later. This version includes a fix for the token verification process, ensuring that the signature of the token is properly validated.
As a temporary workaround, you can modify the Pulsar configuration to disallow tokens with the algorithm set to "none". This can be achieved by updating the configuration file to reject tokens that use the "none" algorithm.
For more information about this vulnerability, you can refer to the CVE-2021-22160 advisory or the Apache Pulsar documentation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pulsar:pulsar.
