← Vulnerability feed

Vulnerability record · CVE-2023-51437 · published 7 February 2024

CVE-2023-51437: Apache pulsar observable discrepancy vulnerability

Apache · Pulsar

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file. Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker. 2.11 Pulsar users should upgrade to at least 2.11.3. 3.0 Pulsar users should upgrade to at least 3.0.2. 3.1 Pulsar users should upgrade to at least 3.1.1. Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions. For additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ .

7.4 CVSS 3.1 High EPSS 0.76% · top 46.4% CWE-203 · Observable discrepancy
7.4CVSS 3.1 base score
0.76%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file. Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker. 2.11 Pulsar users should upgrade to at least 2.11.3. 3.0 Pulsar users should upgrade to at least 3.0.2. 3.1 Pulsar users should upgrade to at least 3.1.1. Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions. For additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ .

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5 Issue TrackingVendor Advisory
https://www.openwall.com/lists/oss-security/2024/02/07/1
https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5 Issue TrackingVendor Advisory
https://www.openwall.com/lists/oss-security/2024/02/07/1

Track CVE-2023-51437 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-27135Apache pulsar improper input validation vulnerabilityImproper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function w…EPSS 6.0%9.9CVE-2024-27317Apache Pulsar Functions Worker zip extraction path traversalAuthenticated users can upload function jar or nar files to the Pulsar Functions Worker, which extracts them as zip archives without validating filen…EPSS 57%analysed9.8CVE-2021-22160Apache Pulsar JWT authentication bypass via alg=noneApache Pulsar, when configured to authenticate clients with JWT-based tokens, fails to validate the token signature if the presented token declares t…EPSS 53%analysed8.8CVE-2024-27894Apache pulsar improper input validation vulnerabilityThe Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referen…EPSS 1.9%8.8CVE-2023-30429Apache pulsar incorrect authorization vulnerabilityIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When …EPSS 1.0%8.2CVE-2022-34321Apache pulsar missing authentication for critical function vulnerabilityImproper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The v…EPSS 1.8%8.1CVE-2023-30428Apache pulsar incorrect authorization vulnerabilityIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP…EPSS 0.82%8.1CVE-2022-33684Apache pulsar improper certificate validation vulnerabilityThe Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllo…EPSS 0.74%

Source: NIST National Vulnerability Database (record CVE-2023-51437), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.