CVE-2023-51437

{"id": "CVE-2023-51437", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2024-02-07T10:15:08.137", "references": [{"url": "https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/07/1", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.openwall.com/lists/oss-security/2024/02/07/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-203"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification.\nUsers are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file.\n\nAny component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker.\n\n2.11 Pulsar users should upgrade to at least 2.11.3.\n3.0 Pulsar users should upgrade to at least 3.0.2.\n3.1 Pulsar users should upgrade to at least 3.1.1.\nAny users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions.\n\nFor additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ .\n\n"}, {"lang": "es", "value": "Una vulnerabilidad de discrepancia de tiempo observable en Apache Pulsar SASL Authentication Provider puede permitir a un atacante falsificar un token de funci\u00f3n SASL que pasar\u00e1 la verificaci\u00f3n de firma. Se recomienda a los usuarios actualizar a la versi\u00f3n 2.11.3, 3.0.2 o 3.1.1, que soluciona el problema. Los usuarios tambi\u00e9n deber\u00edan considerar actualizar el secreto configurado en el archivo `saslJaasServerRoleTokenSignerSecretPath`. Cualquier componente que coincida con una versi\u00f3n anterior que ejecute el proveedor de autenticaci\u00f3n SASL se ver\u00e1 afectado. Eso incluye Pulsar Broker, Proxy, Websocket Proxy o Function Worker. 2.11 Los usuarios de Pulsar deben actualizar al menos a 2.11.3. Los usuarios de Pulsar 3.0 deben actualizar al menos a 3.0.2. 3.1 Los usuarios de Pulsar deben actualizar al menos a 3.1.1. Cualquier usuario que ejecute Pulsar 2.8, 2.9, 2.10 y versiones anteriores debe actualizar a una de las versiones parcheadas anteriores. Para obtener detalles adicionales sobre este vector de ataque, consulte https://codahale.com/a-lesson-in-timing-attacks/."}], "lastModified": "2024-11-21T08:38:06.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DA223E6-F59D-4BB5-971A-1CC1914C70E4", "versionEndIncluding": "2.10.5"}, {"criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDA5C2BD-D15D-40F8-8418-8382248881E3", "versionEndExcluding": "2.11.3", "versionStartIncluding": "2.11.0"}, {"criteria": "cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F07DBEFA-B9F0-4497-B85A-41C753961E70", "versionEndExcluding": "3.0.2", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:apache:pulsar:3.1.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "447E0901-B5CA-42BE-B894-41E158B123AD"}, {"criteria": "cpe:2.3:a:apache:pulsar:3.1.0:candidate_1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA3F2622-FDD4-48B9-81E3-6BE8B553F77C"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}