{"action":"Upgrade pulsar-client to 2.7.5 or later.","affected":[{"fixed":"2.7.5","introduced":"0"},{"fixed":"2.8.4","introduced":"2.8.0"},{"fixed":"2.9.3","introduced":"2.9.0"},{"fixed":"2.10.2","introduced":"2.10.0"}],"component":"pulsar-client","cve_ids":["CVE-2022-33684"],"ecosystem":"PyPI","epss":0.00775,"exploited":false,"fixed_versions":["2.7.5","2.8.4","2.9.3","2.10.2"],"ghsa_id":"GHSA-5r3h-c3r7-9w4h","id":"tcs_01M5KF1MGJC04RJSMEE3P930FG","modified_at":"2026-07-07T11:56:33.909169602Z","published_at":"2022-11-04T19:01:17Z","references":["https://osv.dev/vulnerability/GHSA-5r3h-c3r7-9w4h","https://nvd.nist.gov/vuln/detail/CVE-2022-33684","https://github.com/apache/pulsar/pull/16064","https://github.com/apache/pulsar-client-cpp","https://huntr.dev/bounties/df89b724-3201-47aa-b8cd-282e112a566f","https://lists.apache.org/thread/ky1ssskvkj00y36k7nys9b5gm5jjrzwv"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-5r3h-c3r7-9w4h","url":"https://osv.dev/vulnerability/GHSA-5r3h-c3r7-9w4h"}],"summary":"Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack"}