CVE-2024-27135
Apache Pulsar Function Worker: authenticated user can run arbitrary Java code outside the function sandbox
Technology
Apache Pulsar
CVSS Score
9.9 / 10.0
Affected Versions
2.4.0 to 2.10.5; 2.11.0 to 2.11.3; 3.0.0 to 3.0.2; 3.1.0 to 3.1.2; 3.2.0
Upstream Fix
2.10.6; 2.11.4; 3.0.3; 3.1.3; 3.2.1
Published
March 12, 2024
OSSeva Coverage
Fixed upstream
Description
Improper input validation in the Pulsar Function Worker lets a malicious authenticated user execute arbitrary Java code on the worker, outside the sandboxes meant for user-provided functions. Brokers configured with functionsWorkerEnabled=true are affected too. Apache scores it 8.5 as the CNA.
Is your Apache Pulsar deployment affected?
If you're running 2.4.0 to 2.10.5; 2.11.0 to 2.11.3; 3.0.0 to 3.0.2; 3.1.0 to 3.1.2; 3.2.0, you need this patch. Book a discovery call to get covered.