{"action":"Upgrade org.apache.pulsar:pulsar-broker-auth-sasl to 2.11.3 (2.11.x), 3.0.2 (3.0.x) or 3.1.1 (3.1.x) or later.","affected":[{"fixed":"2.11.3","introduced":"0"},{"fixed":"3.0.2","introduced":"3.0.0"},{"fixed":"3.1.1","introduced":"3.1.0"}],"component":"org.apache.pulsar:pulsar-broker-auth-sasl","cve_ids":["CVE-2023-51437"],"ecosystem":"Maven","epss":0.00763,"exploited":false,"fixed_versions":["2.11.3","3.0.2","3.1.1"],"ghsa_id":"GHSA-c57v-4vg5-cm2x","id":"tcs_01M5N8RKSXDJ0H95HYV8MRMDET","modified_at":"2024-07-22T09:45:44.129610Z","published_at":"2024-02-07T12:30:25Z","references":["https://osv.dev/vulnerability/GHSA-c57v-4vg5-cm2x","https://nvd.nist.gov/vuln/detail/CVE-2023-51437","https://github.com/apache/pulsar/pull/21061","https://github.com/apache/pulsar/commit/6274fa01a75d74d559bb7e514c970f1fc07d15bc","https://github.com/apache/pulsar/commit/bc1019fa8ed37b8a4c8bb01e3662c6c015e1bc27","https://github.com/apache/pulsar/commit/c05954e66ff33098aeb848f4bde51613ace7e47e","https://github.com/apache/pulsar/commit/c27beca64cc93848c40a374f19eaf4d3cc4f4f03","https://github.com/apache/pulsar","https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5","https://www.openwall.com/lists/oss-security/2024/02/07/1","http://www.openwall.com/lists/oss-security/2024/02/07/1"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-c57v-4vg5-cm2x","url":"https://osv.dev/vulnerability/GHSA-c57v-4vg5-cm2x"}],"summary":"Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability"}