Timing Discrepancy Vulnerability Affects Pulsar Users

CVE-2023-51437

Summary

The Apache Pulsar SASL Authentication Provider contains an observable timing discrepancy vulnerability that can be exploited to forge SASL Role Tokens. This vulnerability allows attackers to bypass signature verification, posing a significant security risk. To mitigate this vulnerability, it is imperative for users to upgrade to respective patched versions: 2.11.3, 3.0.2, or 3.1.1, depending on their current version. Additionally, users should update the secret configured in the saslJaasServerRoleTokenSignerSecretPath file to enhance security. All components running affected versions of the SASL Authentication Provider, including the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker, are vulnerable.

References