Bug 2269259 (CVE-2024-27894)
Summary: | CVE-2024-27894 apache-pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Marco Benatto <mbenatto> |
Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
Status: | NEW --- | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | aileenc, asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, cmiranda, darran.lofthouse, dkreling, dosoudil, fjuma, fmariani, gmalinko, ivassile, iweiss, janstey, jpoth, lgao, mosmerov, msochure, mstefank, msvehla, nwallace, pcongius, pdelbell, pjindal, pmackay, rstancel, smaestri, tcunning, tom.jenkinson, yfang |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: |
A vulnerability was found in Apache Pulsar's ability to create functions through URL schemes. When retrieving the function implementation contained in the URL, Pulsar fails to limit access to some privileged resources. As a result, this flaw allows an attacker to gain access to sensitive information such as secrets, access to remote HTTP and HTTPS endpoints data, and possibly cause a denial of service. This vulnerability also affects Pulsar Broker deployments with the flag "functionsWorkerEnabled=true".
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | Type: | --- | |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | |||
Bug Blocks: | 2269246 |
Description
Marco Benatto
2024-03-12 20:36:47 UTC
|