Detections
Analytics

SCA: security update for org.apache.pulsar:pulsar-broker (GHSA-7mg2-6c6v-342r)

medium Tenable Self-Hosted Container Security Plugin ID 412141

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized
 operations on partitioned topics, such as unloading topics and triggering compaction. These management
 operations should be restricted to users with the tenant admin role or superuser role. An authenticated
 user with produce permission can create subscriptions and update subscription properties on partitioned
 topics, even though this should be limited to users with consume permissions. This impact analysis assumes
 that Pulsar has been configured with the default authorization provider. For custom authorization
 providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated
 user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar,
 namespace properties are reserved for user provided metadata about the namespace. This issue affects
 Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to
 3.1.3, and from 3.2.0 to 3.2.1. 3.0 Apache Pulsar users should upgrade to at least 3.0.4. 3.1 and 3.2
 Apache Pulsar users should upgrade to at least 3.2.2. Users operating versions prior to those listed above
 should upgrade to the aforementioned patched versions or newer versions. (CVE-2024-29834)

See Also

https://github.com/advisories/GHSA-7mg2-6c6v-342r

Plugin Details

Severity: Medium

ID: 412141

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2024-29834

CVSS v3

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/2/2024

Vulnerability Publication Date: 4/2/2024

Reference Information

CVE: CVE-2024-29834

cwe: CWE-863