cnvd - cnvd-2022-69470

cnvd-2022-69470

Vulnerability from cnvd

Title: Apache Pulsar信任管理问题漏洞

Description:

Apache Pulsar是美国阿帕奇（Apache）基金会的一个用于云环境种，集消息、存储、轻量化函数式计算为一体的分布式消息流平台。该软件支持多租户、持久化存储、多机房跨区域数据复制，具有强一致性、高吞吐以及低延时的高可扩展流数据存储特性。

Apache Pulsar存在安全漏洞，该漏洞源于Apache Pulsar Brokers and Proxies 创建一个内部 Pulsar Admin Client，它不会验证对等 TLS 证书，即使通过配置禁用了 tlsAllowInsecureConnection，攻击者可利用该漏洞通过Proxy Admin客户端实现中间人攻击。

Severity: 中

Patch Name: Apache Pulsar信任管理问题漏洞的补丁

Patch Description:

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-33683

Impacted products

Name
['Apache Pulsar <2.7.5', 'Apache Pulsar >=2.8.0，<2.8.4', 'Apache Pulsar >=2.9.0，<2.9.3', 'Apache Pulsar 2.10.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-33683",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-33683"
    }
  },
  "description": "Apache Pulsar\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u7528\u4e8e\u4e91\u73af\u5883\u79cd\uff0c\u96c6\u6d88\u606f\u3001\u5b58\u50a8\u3001\u8f7b\u91cf\u5316\u51fd\u6570\u5f0f\u8ba1\u7b97\u4e3a\u4e00\u4f53\u7684\u5206\u5e03\u5f0f\u6d88\u606f\u6d41\u5e73\u53f0\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u591a\u79df\u6237\u3001\u6301\u4e45\u5316\u5b58\u50a8\u3001\u591a\u673a\u623f\u8de8\u533a\u57df\u6570\u636e\u590d\u5236\uff0c\u5177\u6709\u5f3a\u4e00\u81f4\u6027\u3001\u9ad8\u541e\u5410\u4ee5\u53ca\u4f4e\u5ef6\u65f6\u7684\u9ad8\u53ef\u6269\u5c55\u6d41\u6570\u636e\u5b58\u50a8\u7279\u6027\u3002\n\nApache Pulsar\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eApache Pulsar Brokers and Proxies \u521b\u5efa\u4e00\u4e2a\u5185\u90e8 Pulsar Admin Client\uff0c\u5b83\u4e0d\u4f1a\u9a8c\u8bc1\u5bf9\u7b49 TLS \u8bc1\u4e66\uff0c\u5373\u4f7f\u901a\u8fc7\u914d\u7f6e\u7981\u7528\u4e86 tlsAllowInsecureConnection\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7Proxy Admin\u5ba2\u6237\u7aef\u5b9e\u73b0\u4e2d\u95f4\u4eba\u653b\u51fb\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-69470",
  "openTime": "2022-10-18",
  "patchDescription": "Apache Pulsar\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u7528\u4e8e\u4e91\u73af\u5883\u79cd\uff0c\u96c6\u6d88\u606f\u3001\u5b58\u50a8\u3001\u8f7b\u91cf\u5316\u51fd\u6570\u5f0f\u8ba1\u7b97\u4e3a\u4e00\u4f53\u7684\u5206\u5e03\u5f0f\u6d88\u606f\u6d41\u5e73\u53f0\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u591a\u79df\u6237\u3001\u6301\u4e45\u5316\u5b58\u50a8\u3001\u591a\u673a\u623f\u8de8\u533a\u57df\u6570\u636e\u590d\u5236\uff0c\u5177\u6709\u5f3a\u4e00\u81f4\u6027\u3001\u9ad8\u541e\u5410\u4ee5\u53ca\u4f4e\u5ef6\u65f6\u7684\u9ad8\u53ef\u6269\u5c55\u6d41\u6570\u636e\u5b58\u50a8\u7279\u6027\u3002\r\n\r\nApache Pulsar\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eApache Pulsar Brokers and Proxies \u521b\u5efa\u4e00\u4e2a\u5185\u90e8 Pulsar Admin Client\uff0c\u5b83\u4e0d\u4f1a\u9a8c\u8bc1\u5bf9\u7b49 TLS \u8bc1\u4e66\uff0c\u5373\u4f7f\u901a\u8fc7\u914d\u7f6e\u7981\u7528\u4e86 tlsAllowInsecureConnection\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7Proxy Admin\u5ba2\u6237\u7aef\u5b9e\u73b0\u4e2d\u95f4\u4eba\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Pulsar\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Pulsar \u003c2.7.5",
      "Apache Pulsar \u003e=2.8.0\uff0c\u003c2.8.4",
      "Apache Pulsar \u003e=2.9.0\uff0c\u003c2.9.3",
      "Apache Pulsar 2.10.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-33683",
  "serverity": "\u4e2d",
  "submitTime": "2022-09-28",
  "title": "Apache Pulsar\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2022-33683 (GCVE-0-2022-33683)

Vulnerability from cvelistv5

Published

2022-09-23 09:25

Modified

2025-05-22 18:27

Severity ?

CWE

CWE-295 - Improper Certificate Validation

Summary

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.

References

▼	URL	Tags
	https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Pulsar	Version: 2.10.0 Version: 2.7 < Version: 2.8 < Version: 2.9 < Version: 2.6 and earlier <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:09:22.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-33683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T15:49:58.425084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T18:27:17.447Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Pulsar",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "2.10.0"
            },
            {
              "lessThanOrEqual": "2.7.4",
              "status": "affected",
              "version": "2.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.8.3",
              "status": "affected",
              "version": "2.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.9.2",
              "status": "affected",
              "version": "2.9",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.6.4",
              "status": "affected",
              "version": "2.6 and earlier",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Michael Marshall of DataStax."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client\u0027s intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine \u0027between\u0027 the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "high"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-23T09:25:15.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack ",
      "workarounds": [
        {
          "lang": "en",
          "value": "Any users running affected versions of the Pulsar Broker or Pulsar Proxy should rotate static authentication data vulnerable to man in the middle attacks used by these applications, including tokens and passwords.\n\n2.7 users should upgrade Pulsar Brokers and Proxies to 2.7.5, and rotate vulnerable authentication data, including tokens and passwords.\n2.8 users should upgrade Pulsar Brokers and Proxies to 2.8.4, and rotate vulnerable authentication data, including tokens and passwords.\n2.9 users should upgrade Pulsar Brokers and Proxies to 2.9.3, and rotate vulnerable authentication data, including tokens and passwords.\n2.10 users should upgrade Pulsar Brokers and Proxies to 2.10.1, and rotate vulnerable authentication data, including tokens and passwords.\nAny users running Pulsar Brokers and Proxies for 2.6 and earlier should upgrade to one of the above patched versions, and rotate vulnerable authentication data, including tokens and passwords.\n\nIn addition to upgrading, it is also necessary to enable hostname verification to prevent man in the middle attacks. Please see CVE-2022-33682 for more information."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-33683",
          "STATE": "PUBLIC",
          "TITLE": "Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack "
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Pulsar",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "2.7",
                            "version_value": "2.7.4"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "2.8",
                            "version_value": "2.8.3"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "2.9",
                            "version_value": "2.9.2"
                          },
                          {
                            "version_affected": "=",
                            "version_name": "2.10",
                            "version_value": "2.10.0"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "2.6 and earlier",
                            "version_value": "2.6.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This issue was discovered by Michael Marshall of DataStax."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client\u0027s intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine \u0027between\u0027 the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "high"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-295 Improper Certificate Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/42v5rsxj36r3nhfxhmhb2x12r5jmvx3x"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Any users running affected versions of the Pulsar Broker or Pulsar Proxy should rotate static authentication data vulnerable to man in the middle attacks used by these applications, including tokens and passwords.\n\n2.7 users should upgrade Pulsar Brokers and Proxies to 2.7.5, and rotate vulnerable authentication data, including tokens and passwords.\n2.8 users should upgrade Pulsar Brokers and Proxies to 2.8.4, and rotate vulnerable authentication data, including tokens and passwords.\n2.9 users should upgrade Pulsar Brokers and Proxies to 2.9.3, and rotate vulnerable authentication data, including tokens and passwords.\n2.10 users should upgrade Pulsar Brokers and Proxies to 2.10.1, and rotate vulnerable authentication data, including tokens and passwords.\nAny users running Pulsar Brokers and Proxies for 2.6 and earlier should upgrade to one of the above patched versions, and rotate vulnerable authentication data, including tokens and passwords.\n\nIn addition to upgrading, it is also necessary to enable hostname verification to prevent man in the middle attacks. Please see CVE-2022-33682 for more information."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-33683",
    "datePublished": "2022-09-23T09:25:15.000Z",
    "dateReserved": "2022-06-15T00:00:00.000Z",
    "dateUpdated": "2025-05-22T18:27:17.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted