SCA: security update for org.apache.pulsar:pulsar-broker (GHSA-47r2-phr8-m8cp)

medium Tenable Self-Hosted Container Security Plugin ID 410026

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client
to stay connected to a broker after authentication data expires if the client connected through the Pulsar
Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects
directly to a broker with a specially crafted connect command when the broker is configured with
authenticateOriginalAuthData=false. This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through
2.10.3, 2.11.0. 2.9 Pulsar Broker users should upgrade to at least 2.9.5. 2.10 Pulsar Broker users should
upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker
users are unaffected. Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of
the above patched versions. (CVE-2023-31007)

Plugin Details

Severity: Medium

ID: 410026

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2023-31007

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/12/2023

Vulnerability Publication Date: 7/12/2023

Reference Information

CVE: CVE-2023-31007

cwe: CWE-287

Detections

Analytics