~ / search / GHSA-3cv4-xxv7-934q

GHSA-3cv4-xxv7-934q

Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-22160

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.pulsar:pulsar < 2.7.2 2.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).

References

External links from the advisory. They lead to third-party sites.