2 results · Clear filters · Feed
-
Medium 5.9
Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connecti…
-
Medium 5.9
Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connecti…