CVE-2023-51437

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification.<br /> Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the `saslJaasServerRoleTokenSignerSecretPath` file.<br /> <br /> Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker.<br /> <br /> 2.11 Pulsar users should upgrade to at least 2.11.3.<br /> 3.0 Pulsar users should upgrade to at least 3.0.2.<br /> 3.1 Pulsar users should upgrade to at least 3.1.1.<br /> Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions.<br /> <br /> For additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ .<br /> <br />