Vulnerability in Apache Pulsar
CVE-2022-33684
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker t…
Vulnerability class: Improper Certificate Validation
EPSS: 0.007 (48.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Pulsar
- Apache Software Foundation Pulsar — versions 2.7, 2.8, 2.9
Weakness classification (CWE)
References
- security@apache.org (Mailing List, Issue Tracking, Vendor Advisory)
- security@apache.org (Exploit, Patch, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2022-33684?
- CVE-2022-33684 is a high-severity vulnerability in Apache Pulsar, classified under Improper Certificate Validation. CVSS score: 8.1/10. Published 2022-11-04.
- How severe is CVE-2022-33684?
- High severity. CVSS v3 base score is 8.1 out of 10.