CVE-2022-24280: Apache Pulsar Proxy Denial of Service Vulnerability
Summary
CVE-2022-24280: Proxy component of Apache Pulsar subject to abuse as Denial of Service endpoint. Affects org.apache.pulsar:pulsar across 3 version ranges.
< 2.7.5
>= 2.8.0, < 2.8.3
>= 2.9.0, < 2.9.2
Fixed in 2.7.5, 2.8.3 or 2.9.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Pulsar is an open-source distributed pub-sub messaging system that provides durable message storage and real-time messaging capabilities. The Proxy component of Apache Pulsar acts as an intermediary between clients and brokers, handling client requests and forwarding them to the appropriate broker. It plays a crucial role in the overall functioning of the messaging system.
Vulnerability Detail
The Proxy component of Apache Pulsar is susceptible to an Improper Input Validation vulnerability, which allows an attacker to abuse it as a Denial of Service (DoS) endpoint. By exploiting this vulnerability, an attacker can initiate TCP/IP connection attempts originating from the Pulsar Proxy's IP address. This enables the attacker to launch DoS attacks from the Proxy's IP address. It is important to note that the Pulsar Proxy authentication mechanism itself is not bypassed. The attacker must possess a valid token to a properly secured Pulsar Proxy. This vulnerability affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4, 2.8.0 to 2.8.2, 2.9.0 to 2.9.1, and 2.6.4 and earlier.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.7.52.7.5 -
>= 2.8.0, < 2.8.32.8.3 -
>= 2.9.0, < 2.9.22.9.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to apply the fix by upgrading to the latest version of Apache Pulsar Proxy.
Conclusion
The Apache Pulsar Proxy Denial of Service vulnerability (CVE-2022-24280) allows an attacker to abuse the Proxy component as a DoS endpoint. To mitigate this vulnerability, it is crucial to upgrade to the latest version of Apache Pulsar Proxy. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.pulsar:pulsar →
FAQ
Apache Pulsar Proxy is a component of the Apache Pulsar messaging system that acts as an intermediary between clients and brokers, handling client requests and forwarding them to the appropriate broker.
This vulnerability allows an attacker to abuse the Proxy component of Apache Pulsar as a DoS endpoint, potentially leading to service disruption and unavailability.
No, the Pulsar Proxy authentication mechanism itself is not bypassed. The attacker must have a valid token to a properly secured Pulsar Proxy.
This vulnerability affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4, 2.8.0 to 2.8.2, 2.9.0 to 2.9.1, and 2.6.4 and earlier.
To fix this vulnerability, it is recommended to upgrade to the latest version of Apache Pulsar Proxy (2.7.5, 2.8.3, or 2.9.2).
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pulsar:pulsar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
