Apache Pulsar: Timing attack in SASL token signature verification
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-203.
Summary
Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file. Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker. 2.11 Pulsar users should upgrade to at least 2.11.3. 3.0 Pulsar users should upgrade to at least 3.0.2. 3.1 Pulsar users should upgrade to at least 3.1.1. Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions. For additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ .
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Pulsar | up to 2.10.5; 2.11.0 – 2.11.2; 3.0.0 – 3.0.1; 3.1.0 | — | No fix listed | CNA |
| — | org.apache.pulsar:pulsar-broker-auth-sasl (Maven) | before 2.11.3 | 2.11.3 | Patch available | GHSA-c57v-4vg5-cm2x |
| — | org.apache.pulsar:pulsar-broker-auth-sasl (Maven) | 3.0.0 to before 3.0.2 | 3.0.2 | Patch available | GHSA-c57v-4vg5-cm2x |
| — | org.apache.pulsar:pulsar-broker-auth-sasl (Maven) | 3.1.0 to before 3.1.1 | 3.1.1 | Patch available | GHSA-c57v-4vg5-cm2x |
- Apache Pulsar VendorApache Affected up to 2.10.5; 2.11.0 – 2.11.2; 3.0.0 – 3.0.1; 3.1.0 Fixed in — No fix listed CNA
- org.apache.pulsar:pulsar-broker-auth-sasl (Maven) Vendor— Affected before 2.11.3 Fixed in 2.11.3 Patch available GHSA-c57v-4vg5-cm2x
- org.apache.pulsar:pulsar-broker-auth-sasl (Maven) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-c57v-4vg5-cm2x
- org.apache.pulsar:pulsar-broker-auth-sasl (Maven) Vendor— Affected 3.1.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-c57v-4vg5-cm2x
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* | up to 2.10.5; 2.11.0 to before 2.11.3; 3.0.0 to before 3.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:pulsar:3.1.0:-:*:*:*:*:*:* | 3.1.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:pulsar:3.1.0:candidate_1:*:*:*:*:*:* | 3.1.0 candidate_1 | Vulnerable | Apache |
- cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions up to 2.10.5; 2.11.0 to before 2.11.3; 3.0.0 to before 3.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:pulsar:3.1.0:-:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Apache
- cpe:2.3:a:apache:pulsar:3.1.0:candidate_1:*:*:*:*:*:* Versions 3.1.0 candidate_1 Vulnerable ·Apache
Remediation
- Fix · GHSA-c57v-4vg5-cm2x org.apache.pulsar:pulsar-broker-auth-sasl (Maven) Fixed in 2.11.3 Advisory →
- Fix · GHSA-c57v-4vg5-cm2x org.apache.pulsar:pulsar-broker-auth-sasl (Maven) Fixed in 3.0.2 Advisory →
- Fix · GHSA-c57v-4vg5-cm2x org.apache.pulsar:pulsar-broker-auth-sasl (Maven) Fixed in 3.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-51437
- 2026-10-03 Alias added: GHSA-c57v-4vg5-cm2x
References
Advisory 2
Other 8
- https://www.openwall.com/lists/oss-security/2024/02/07/1
- https://github.com/apache/pulsar/pull/21061
- https://github.com/apache/pulsar/commit/6274fa01a75d74d559bb7e514c970f1fc07d15bc
- https://github.com/apache/pulsar/commit/bc1019fa8ed37b8a4c8bb01e3662c6c015e1bc27
- https://github.com/apache/pulsar/commit/c05954e66ff33098aeb848f4bde51613ace7e47e
- https://github.com/apache/pulsar/commit/c27beca64cc93848c40a374f19eaf4d3cc4f4f03
- https://github.com/apache/pulsar
- http://www.openwall.com/lists/oss-security/2024/02/07/1
More Apache Pulsar vulnerabilities
- TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
- TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
- TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
- TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
- TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
- TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
Sources
- CVE-2023-51437 · CVE Program
- CVE-2023-51437 · NVD
- FIRST EPSS
- GHSA-c57v-4vg5-cm2x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences