CVE-2021-41571: Pulsar Admin API allows access to data from other tenants using getMessageById API
First published: Tue Feb 01 2022(Updated: )
In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Pulsar | >=2.6.0<2.6.4 | |
| Apache Pulsar | >=2.7.0<2.7.3 | |
| Apache Pulsar | =2.8.0 | |
| maven/org.apache.pulsar:pulsar | =2.8.0 | 2.8.1 |
| maven/org.apache.pulsar:pulsar | >=2.7.0<=2.7.3 | 2.7.4 |
| maven/org.apache.pulsar:pulsar | <=2.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2021-41571
- https://github.com/apache/pulsar/issues/11814
- https://lists.apache.org/thread/8n3k7pvyh4cf9q2jfzb6pb32ync6xlvr
- https://pulsar.apache.org/admin-rest-api/#operation/getLastMessageId
- https://github.com/apache/pulsar/pull/11852
- https://github.com/apache/pulsar/pull/11912
- https://github.com/apache/pulsar/pull/11913
- https://github.com/apache/pulsar/releases/tag/v2.7.4
- https://github.com/apache/pulsar/releases/tag/v2.8.1
- https://github.com/advisories/GHSA-3whx-qrj5-hh2h (Advisory)
Frequently Asked Questions
What is CVE-2021-41571?
CVE-2021-41571 is a vulnerability in Apache Pulsar that allows unauthorized access to data from BookKeeper.
How does CVE-2021-41571 work?
CVE-2021-41571 allows an authenticated user to access data from BookKeeper that does not belong to the topics they have access to by using the Admin API get-message-by-id function.
What is the severity of CVE-2021-41571?
CVE-2021-41571 has a severity score of 6.5 (medium).
Which versions of Apache Pulsar are affected by CVE-2021-41571?
CVE-2021-41571 affects Apache Pulsar versions 2.6.0 to 2.6.4, 2.7.0 to 2.7.3, and 2.8.0.
How can I fix CVE-2021-41571 in Apache Pulsar?
To fix CVE-2021-41571 in Apache Pulsar, upgrade to version 2.7.4 or 2.8.1.
- collector/github-advisory-latest
- alias/GHSA-3whx-qrj5-hh2h
- alias/CVE-2021-41571
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/tags
- agent/event
- package-manager/maven
- vendor/apache
- canonical/apache pulsar
- version/apache pulsar/2.6.0
- version/apache pulsar/2.7.0
- version/apache pulsar/2.8.0