Apache ZooKeeper multiple flaws allow access bypass and crashes
Apache ZooKeeper, which coordinates many servers, can be stopped or lose its permissions.
Summary
Several flaws in the Apache ZooKeeper server let a client keep operations after its permission is revoked, forge its authentication identity, or stop the server. Servers running versions up to 3.9.6 are affected.
Affected when
- Transition from OPEN_ACL_UNSAFE to a restrictive ACL
- SASL authentication enabled on the client port
- Default /zookeeper/quota subtree (world-writable)
- Default open root ACL allowing znode creation
What to do
Update to ZooKeeper 3.8.8 or 3.9.7. Until then, restrict znode creation with ACLs and authentication.
Products and platforms
CVE IDs
Sources
- Advisory: lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab) · lists.apache.org (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen