fkie_cve-2024-29834
Vulnerability from fkie_nvd
Published
2024-04-02 20:15
Modified
2025-01-24 16:21
Severity ?
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
6.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Summary
This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned topics, even though this should be limited to users with consume permissions. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar, namespace properties are reserved for user provided metadata about the namespace. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to 3.1.3, and from 3.2.0 to 3.2.1. 3.0 Apache Pulsar users should upgrade to at least 3.0.4. 3.1 and 3.2 Apache Pulsar users should upgrade to at least 3.2.2. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
References
security@apache.orghttp://www.openwall.com/lists/oss-security/2024/04/02/2Mailing List, Third Party Advisory
security@apache.orghttps://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5Mailing List, Vendor Advisory
security@apache.orghttps://pulsar.apache.org/security/CVE-2024-29834/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/04/02/2Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://pulsar.apache.org/security/CVE-2024-29834/Vendor Advisory
Impacted products
Vendor Product Version
apache pulsar *
apache pulsar *
apache pulsar *
apache pulsar *
apache pulsar *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F72E981-1033-4288-B32A-D8BA23842F0A",
                     versionEndIncluding: "2.10.6",
                     versionStartIncluding: "2.7.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "BA0ADBDB-CBD3-465A-8A24-CA20BE0F2965",
                     versionEndIncluding: "2.11.4",
                     versionStartIncluding: "2.11.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "39CB0C2C-FFA0-47AD-AE95-33EDCD69D747",
                     versionEndExcluding: "3.0.4",
                     versionStartIncluding: "3.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3B345AA3-0ACC-4953-B214-F505CDB077F6",
                     versionEndIncluding: "3.1.3",
                     versionStartIncluding: "3.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "92141F66-6615-4D09-9CD1-FB2341B7194E",
                     versionEndExcluding: "3.2.2",
                     versionStartIncluding: "3.2.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned topics, even though this should be limited to users with consume permissions. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar, namespace properties are reserved for user provided metadata about the namespace.\n\nThis issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to 3.1.3, and from 3.2.0 to 3.2.1. \n\n3.0 Apache Pulsar users should upgrade to at least 3.0.4.\n3.1 and 3.2 Apache Pulsar users should upgrade to at least 3.2.2.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a los usuarios autenticados con permisos de producción o consumo realizar operaciones no autorizadas en temas particionados, como descargar temas y activar la compactación. Estas operaciones de administración deben restringirse a los usuarios con la función de administrador de inquilinos o la función de superusuario. Un usuario autenticado con permiso de producción puede crear suscripciones y actualizar propiedades de suscripción en temas particionados, aunque esto debería limitarse a usuarios con permisos de consumo. Este análisis de impacto supone que Pulsar se ha configurado con el proveedor de autorización predeterminado. Para los proveedores de autorizaciones personalizadas, el impacto podría ser ligeramente diferente. Además, la vulnerabilidad permite a un usuario autenticado leer, crear, modificar y eliminar propiedades de espacio de nombres en cualquier espacio de nombres de cualquier inquilino. En Pulsar, las propiedades del espacio de nombres están reservadas para los metadatos proporcionados por el usuario sobre el espacio de nombres. Este problema afecta a las versiones de Apache Pulsar de 2.7.1 a 2.10.6, de 2.11.0 a 2.11.4, de 3.0.0 a 3.0.3, de 3.1.0 a 3.1.3 y de 3.2.0 a 3.2. 1. Los usuarios de Apache Pulsar 3.0 deben actualizar al menos a 3.0.4. Los usuarios de Apache Pulsar 3.1 y 3.2 deben actualizar al menos a 3.2.2. Los usuarios que utilicen versiones anteriores a las enumeradas anteriormente deben actualizar a las versiones parcheadas antes mencionadas o a versiones más nuevas.",
      },
   ],
   id: "CVE-2024-29834",
   lastModified: "2025-01-24T16:21:24.170",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.1,
            impactScore: 2.7,
            source: "security@apache.org",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.1,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-02T20:15:09.607",
   references: [
      {
         source: "security@apache.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2024/04/02/2",
      },
      {
         source: "security@apache.org",
         tags: [
            "Mailing List",
            "Vendor Advisory",
         ],
         url: "https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5",
      },
      {
         source: "security@apache.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://pulsar.apache.org/security/CVE-2024-29834/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2024/04/02/2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Vendor Advisory",
         ],
         url: "https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://pulsar.apache.org/security/CVE-2024-29834/",
      },
   ],
   sourceIdentifier: "security@apache.org",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-863",
            },
         ],
         source: "security@apache.org",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.