CVE-2021-22160
Authentication with JWT allows use of “none”-algorithm
- State
- Published
- Severity
- Not scored
- Published
- May 26, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 5, 2021
Description
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache PulsarApache Software Foundation |
|
References
- https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E
- [pulsar-dev] 20210527 Cutting 2.6.4 release to address CVE-2021-22160mailing-list
- [pulsar-dev] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of "none"-algorithmmailing-list
- [pulsar-users] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of "none"-algorithmmailing-list
- [pulsar-dev] 20210527 Re: Cutting 2.6.4 release to address CVE-2021-22160mailing-list
- Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of “none”-algorithmmailing-list
- [pulsar-dev] 20210531 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versionsmailing-list
- [pulsar-dev] 20210604 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versionsmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.