tocsin

PyPI/pulsar-client CVE-2022-33684: high 8.1, EPSS 0.78%

Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

Action: Upgrade pulsar-client to 2.7.5 or later.

pip install pulsar-client==2.7.5
pip install pulsar-client==2.8.4
pip install pulsar-client==2.9.3
pip install pulsar-client==2.10.2

Affected

introducedfixedlast affected
02.7.5-
2.8.02.8.4-
2.9.02.9.3-
2.10.02.10.2-

Fixed versions

2.7.52.8.42.9.32.10.2

Sources

CVE-2022-33684 · published · modified · JSON