Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.pulsar/pulsar-broker@2.6.0
Typemaven
Namespaceorg.apache.pulsar
Namepulsar-broker
Version2.6.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.6.4
Latest_non_vulnerable_version3.2.2
Affected_by_vulnerabilities
0
url VCID-tgsv-dh9e-6fc3
vulnerability_id VCID-tgsv-dh9e-6fc3
summary 
Incorrect Authorization
In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.
references
0
reference_url https://github.com/apache/pulsar/issues/11814
reference_id
reference_type
scores
url https://github.com/apache/pulsar/issues/11814
1
reference_url https://lists.apache.org/thread/8n3k7pvyh4cf9q2jfzb6pb32ync6xlvr
reference_id
reference_type
scores
url https://lists.apache.org/thread/8n3k7pvyh4cf9q2jfzb6pb32ync6xlvr
2
reference_url https://pulsar.apache.org/admin-rest-api/#operation/getLastMessageId
reference_id
reference_type
scores
url https://pulsar.apache.org/admin-rest-api/#operation/getLastMessageId
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-41571
reference_id CVE-2021-41571
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2021-41571
fixed_packages
0
url pkg:maven/org.apache.pulsar/pulsar-broker@2.6.4
purl pkg:maven/org.apache.pulsar/pulsar-broker@2.6.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.pulsar/pulsar-broker@2.6.4
1
url pkg:maven/org.apache.pulsar/pulsar-broker@2.7.3
purl pkg:maven/org.apache.pulsar/pulsar-broker@2.7.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.pulsar/pulsar-broker@2.7.3
2
url pkg:maven/org.apache.pulsar/pulsar-broker@2.8.1
purl pkg:maven/org.apache.pulsar/pulsar-broker@2.8.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.pulsar/pulsar-broker@2.8.1
aliases CVE-2021-41571
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tgsv-dh9e-6fc3
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.pulsar/pulsar-broker@2.6.0