{"action":"Upgrade org.apache.pulsar:pulsar-broker to 3.0.4 (3.0.x) or 3.2.2 (3.2.x) or later.","affected":[{"introduced":"2.7.1","last_affected":"2.10.6"},{"introduced":"2.11.0","last_affected":"2.11.4"},{"fixed":"3.0.4","introduced":"3.0.0"},{"introduced":"3.1.0","last_affected":"3.1.3"},{"fixed":"3.2.2","introduced":"3.2.0"}],"component":"org.apache.pulsar:pulsar-broker","cve_ids":["CVE-2024-29834"],"ecosystem":"Maven","epss":0.01359,"exploited":false,"fixed_versions":["3.0.4","3.2.2"],"ghsa_id":"GHSA-7mg2-6c6v-342r","id":"tcs_01M5N8JNFRJ9DDW9CB5SSDT5SP","modified_at":"2024-05-02T19:03:49.413269Z","published_at":"2024-04-02T21:30:27Z","references":["https://osv.dev/vulnerability/GHSA-7mg2-6c6v-342r","https://nvd.nist.gov/vuln/detail/CVE-2024-29834","https://github.com/apache/pulsar/commit/6ffe667cddad3e959e02ce31fd09b2f9a439d50a","https://github.com/apache/pulsar/commit/b51b74883fb66673161d0b73c6a7257d073c57a5","https://github.com/apache/pulsar","https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5","https://pulsar.apache.org/security/CVE-2024-29834","http://www.openwall.com/lists/oss-security/2024/04/02/2"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-7mg2-6c6v-342r","url":"https://osv.dev/vulnerability/GHSA-7mg2-6c6v-342r"}],"summary":"Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints"}