CVE-2021-41571: Improper Input Validation in Apache Pulsar
Summary
CVE-2021-41571: Improper Input Validation in Apache Pulsar. Affects org.apache.pulsar:pulsar across 3 version ranges.
< 2.6.4
>= 2.7.0, < 2.7.4
>= 2.8.0, < 2.8.1
Fixed in 2.6.4, 2.7.4 or 2.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Pulsar is an open-source distributed pub-sub messaging system that offers high-performance, durable messaging. It allows applications to exchange messages in a reliable and scalable manner. This vulnerability affects Apache Pulsar versions 2.8.0 and prior, 2.7.3 and prior, and 2.6.4 and prior. The vulnerability arises from improper input validation in the Admin API get-message-by-id function, which can lead to unauthorized access to data from BookKeeper that does not belong to the topics accessible by the authenticated user.
Vulnerability Detail
The get-message-by-id function in Apache Pulsar's Admin API requires the user to input a topic and a ledger ID. While authorization controls are performed against the topic name, there is no proper validation to ensure that the ledger ID is valid in the context of the ledger. As a result, an authenticated user may be able to read data from a ledger that contains data owned by another tenant. This can lead to unauthorized access to sensitive information and a potential breach of data confidentiality. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.42.6.4 -
>= 2.7.0, < 2.7.42.7.4 -
>= 2.8.0, < 2.8.12.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions mentioned above to mitigate the risk of unauthorized data access.
Conclusion
In conclusion, the vulnerability in Apache Pulsar allows authenticated users to access data from BookKeeper that they should not have access to. Upgrading to the latest fixed versions of Apache Pulsar is crucial to mitigate the risk of unauthorized data access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.pulsar:pulsar →
FAQ
Apache Pulsar is an open-source distributed pub-sub messaging system that provides reliable and scalable messaging capabilities.
This vulnerability affects Apache Pulsar versions 2.8.0 and prior, 2.7.3 and prior, and 2.6.4 and prior.
The vulnerability allows an authenticated user to access data from BookKeeper that does not belong to the topics accessible by the user. This can lead to unauthorized access to sensitive information.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to the latest version of Apache Pulsar (2.7.4 or later for versions 2.7.3 and prior, and 2.8.1 or later for versions 2.8.0 and prior).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pulsar:pulsar.
