MEDIUMFixed upstream

CVE-2024-28098

Apache Pulsar: produce or consume permission allows changing topic-level policies

Technology

Apache Pulsar

CVSS Score

5.4 / 10.0

Affected Versions

2.7.1 to 2.10.5; 2.11.0 to 2.11.3; 3.0.0 to 3.0.2; 3.1.0 to 3.1.2; 3.2.0

Upstream Fix

2.10.6; 2.11.4; 3.0.3; 3.1.3; 3.2.1

Published

March 12, 2024

OSSeva Coverage

Fixed upstream

Description

Authenticated users with only produce or consume permission can modify topic-level policies such as retention, TTL and offloading, which should need the tenant admin or superuser role.

Upstream record: NVD · CVE.org

Is your Apache Pulsar deployment affected?

If you're running 2.7.1 to 2.10.5; 2.11.0 to 2.11.3; 3.0.0 to 3.0.2; 3.1.0 to 3.1.2; 3.2.0, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Pulsar coverage →