{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27135", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-02-20T11:50:02.083Z", "datePublished": "2024-03-12T18:18:06.720Z", "dateUpdated": "2024-08-02T00:27:59.563Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Pulsar", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.10.6", "status": "affected", "version": "2.4.0", "versionType": "semver"}, {"lessThan": "2.11.4", "status": "affected", "version": "2.11.0", "versionType": "semver"}, {"lessThan": "3.0.3", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"lessThan": "3.1.3", "status": "affected", "version": "3.1.0", "versionType": "semver"}, {"lessThan": "3.2.1", "status": "affected", "version": "3.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Lari Hotari of StreamNative"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".<br><br>This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. <br><br>2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.<br>2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.<br>3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.<br>3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.<br>3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.<br><br>Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.<br>"}], "value": "Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".\n\nThis issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. \n\n2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.\n2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.\n3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.\n3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.\n3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n"}], "metrics": [{"other": {"content": {"text": "high"}, "type": "Textual description of severity"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-03-12T18:18:06.720Z"}, "references": [{"tags": ["mailing-list"], "url": "https://lists.apache.org/thread/dh8nj2vmb2br6thjltq74lk9jxkz62wn"}, {"tags": ["vendor-advisory"], "url": "https://pulsar.apache.org/security/CVE-2024-27135/"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/12/9"}], "source": {"discovery": "INTERNAL"}, "title": "Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "apache", "product": "pulsar", "cpes": ["cpe:2.3:a:apache:pulsar:2.4.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.4.0", "status": "affected", "lessThan": "2.10.6", "versionType": "custom"}]}, {"vendor": "apache", "product": "pulsar", "cpes": ["cpe:2.3:a:apache:pulsar:2.11.0:-:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.11.0", "status": "affected", "lessThan": "2.11.4", "versionType": "custom"}]}, {"vendor": "apache", "product": "pulsar", "cpes": ["cpe:2.3:a:apache:pulsar:3.0.0:-:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.0.0", "status": "affected", "lessThan": "3.0.3", "versionType": "custom"}]}, {"vendor": "apache", "product": "pulsar", "cpes": ["cpe:2.3:a:apache:pulsar:3.1.0:-:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.1.0", "status": "affected", "lessThan": "3.1.3", "versionType": "custom"}]}, {"vendor": "apache", "product": "pulsar", "cpes": ["cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.2.0", "status": "affected", "lessThan": "3.2.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-13T14:22:47.701713Z", "id": "CVE-2024-27135", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-24T19:41:30.721Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.563Z"}, "title": "CVE Program Container", "references": [{"tags": ["mailing-list", "x_transferred"], "url": "https://lists.apache.org/thread/dh8nj2vmb2br6thjltq74lk9jxkz62wn"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://pulsar.apache.org/security/CVE-2024-27135/"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/12/9", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/dh8nj2vmb2br6thjltq74lk9jxkz62wn", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://pulsar.apache.org/security/CVE-2024-27135/", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/12/9", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.563Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27135", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-13T14:22:47.701713Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:pulsar:2.4.0:*:*:*:*:*:*:*"], "vendor": "apache", "product": "pulsar", "versions": [{"status": "affected", "version": "2.4.0", "lessThan": "2.10.6", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:apache:pulsar:2.11.0:-:*:*:*:*:*:*"], "vendor": "apache", "product": "pulsar", "versions": [{"status": "affected", "version": "2.11.0", "lessThan": "2.11.4", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:apache:pulsar:3.0.0:-:*:*:*:*:*:*"], "vendor": "apache", "product": "pulsar", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.0.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:apache:pulsar:3.1.0:-:*:*:*:*:*:*"], "vendor": "apache", "product": "pulsar", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "3.1.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:*"], "vendor": "apache", "product": "pulsar", "versions": [{"status": "affected", "version": "3.2.0", "lessThan": "3.2.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-24T19:41:12.980Z"}}], "cna": {"title": "Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Lari Hotari of StreamNative"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "high"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Pulsar", "versions": [{"status": "affected", "version": "2.4.0", "lessThan": "2.10.6", "versionType": "semver"}, {"status": "affected", "version": "2.11.0", "lessThan": "2.11.4", "versionType": "semver"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.3", "versionType": "semver"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.3", "versionType": "semver"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/dh8nj2vmb2br6thjltq74lk9jxkz62wn", "tags": ["mailing-list"]}, {"url": "https://pulsar.apache.org/security/CVE-2024-27135/", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/12/9"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".\n\nThis issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. \n\n2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.\n2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.\n3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.\n3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.\n3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n", "supportingMedia": [{"type": "text/html", "value": "Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".<br><br>This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. <br><br>2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.<br>2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.<br>3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.<br>3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.<br>3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.<br><br>Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-03-12T18:18:06.720Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27135", "state": "PUBLISHED", "dateUpdated": "2024-08-02T00:27:59.563Z", "dateReserved": "2024-02-20T11:50:02.083Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-03-12T18:18:06.720Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".\n\nThis issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. \n\n2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.\n2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.\n3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.\n3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.\n3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n"}, {"lang": "es", "value": "La validaci\u00f3n de entrada incorrecta en Pulsar Function Worker permite que un usuario autenticado malicioso ejecute c\u00f3digo Java arbitrario en Pulsar Function Worker, fuera de los entornos limitados designados para ejecutar funciones proporcionadas por el usuario. Esta vulnerabilidad tambi\u00e9n se aplica al Pulsar Broker cuando est\u00e1 configurado con \"functionsWorkerEnabled=true\". Este problema afecta a las versiones de Apache Pulsar de 2.4.0 a 2.10.5, de 2.11.0 a 2.11.3, de 3.0.0 a 3.0.2, de 3.1.0 a 3.1.2 y 3.2.0. 2.10 Los usuarios de Pulsar Function Worker deben actualizar al menos a 2.10.6. 2.11 Los usuarios de Pulsar Function Worker deben actualizar al menos a 2.11.4. Los usuarios de 3.0 Pulsar Function Worker deben actualizar al menos a 3.0.3. 3.1 Los usuarios de Pulsar Function Worker deben actualizar al menos a 3.1.3. 3.2 Los usuarios de Pulsar Function Worker deben actualizar al menos a 3.2.1. Los usuarios que utilicen versiones anteriores a las enumeradas anteriormente deben actualizar a las versiones parcheadas antes mencionadas o a versiones m\u00e1s nuevas."}], "id": "CVE-2024-27135", "lastModified": "2024-05-01T17:15:30.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security@apache.org", "type": "Secondary"}]}, "published": "2024-03-12T19:15:47.567", "references": [{"source": "security@apache.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/12/9"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread/dh8nj2vmb2br6thjltq74lk9jxkz62wn"}, {"source": "security@apache.org", "url": "https://pulsar.apache.org/security/CVE-2024-27135/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-913"}], "source": "security@apache.org", "type": "Primary"}]}

{"bugzilla": {"description": "apache-pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution", "id": "2269254", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269254"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-20->CWE-913", "details": ["Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with \"functionsWorkerEnabled=true\".\nThis issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. \n2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.\n2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.\n3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.\n3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.\n3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.", "A vulnerability in Apache Pulsar allows a malicious authenticated user to perform remote arbitrary code execution on Pulsar's function worker. A successful attack impacts the data integrity and confidentiality, as well as system availability. Pulsar broker is also susceptible to this attack when it's configured with the \"functionsWorkerEnabled=true\" flag."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-27135", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:3", "fix_state": "Not affected", "package_name": "apache-pulsar", "product_name": "Red Hat build of Apache Camel for Spring Boot"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "apache-pulsar", "product_name": "Red Hat Integration Camel K"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "apache-pulsar", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "apache-pulsar", "product_name": "Red Hat JBoss Fuse 7"}], "public_date": "2024-03-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-27135\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-27135\nhttps://pulsar.apache.org/security/CVE-2024-27135/"], "statement": "Apache Pulsar is not part of EAP - it's not present in the EAP dependency tree and not distributed in the product maven repository. EAP is not affected.", "threat_severity": "Important"}