AVID-2026-R0997

Description

Apache Pulsar Proxy target broker address isn’t validated (CVE-2022-24280)

Details

Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy’s IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An attacker could use this as a way for DoS attacks that originate from the Pulsar Proxy’s IP address. It hasn’t been detected that the Pulsar Proxy authentication can be bypassed. The attacker will have to have a valid token to a properly secured Pulsar Proxy. This issue affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.2; 2.9.0 to 2.9.1; 2.6.4 and earlier.

Reason for inclusion in AVID: CVE-2022-24280 describes an improper input validation vulnerability in the Apache Pulsar Proxy that can be exploited to perform DoS by making TCP/IP connection attempts from the proxy’s IP. Pulsar Proxy is a software component commonly used in data pipelines and AI/ML workloads (data ingestion/streaming) and thus is a software supply-chain element relevant to general-purpose AI systems. The CVE provides explicit vulnerability behavior and affected versions, giving sufficient evidence for inclusion.

References

• NVD entry
• https://lists.apache.org/thread/ghs9jtjfbpy4c6xcftyvkl6swznlom1v

Affected or Relevant Artifacts

• Developer: Apache Software Foundation
• Deployer: Apache Software Foundation
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-09-23
• Version: 0.3.3
• AVID Entry