Authentication and Authorization Flaw in Apache ZooKeeper Versions Prior to 3.4.10
CVE-2018-8012

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Zookeeper
Vendor
CVE Published:
21 May 2018

Summary

An authentication and authorization vulnerability exists in Apache ZooKeeper prior to version 3.4.10 and in versions 3.5.0-alpha through 3.5.3-beta. This flaw allows an arbitrary endpoint to join the ZooKeeper cluster and potentially propagate invalid changes to the leader node. The lack of proper authentication processes poses significant risks to the integrity and stability of the cluster, making it vulnerable to misuse and disruptions.

Affected Version(s)

Apache ZooKeeper Apache ZooKeeper prior to 3.4.10, Apache ZooKeeper 3.5.0-alpha through 3.5.3-beta

References

https://www.debian.org/security/2018/dsa-4214
vendor-advisoryx_refsource_DEBIAN
http://www.securitytracker.com/id/1040948
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/104253
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.