CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504

CVE-2024-51504 affects ZooKeeper Admin Server via IPAuthenticationProvider. Default IP detection uses HTTP headers (X-Forwarded-For) and can be spoofed, leading to authentication bypass for IP-based auth. Admin commands like snapshot/restore may be exploited after bypass. Impact: potential inform...

CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

Apache Zookeeper 安全漏洞

Apache ZooKeeper is a centralized service under the Apache Software Foundation for maintaining configuration information, naming, providing distributed synchronization, and providing group services. An authentication bypass vulnerability exists in Apache ZooKeeper versions prior to 3.9.3. The...

PT-2024-7913

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.9.0 through 3.9.2 Description The issue is related to the IPAuthenticationProvider in the ZooKeeper Admin Server, which allows for authentication bypass via spoofing. This impacts IP-based authentication and is due ...

Security Bulletin: IBM Observability with Instana using third-party Kubernetes Operators is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana using third-party Kubernetes Operators build 283 Vulnerability Details CVEID:CVE-2024-35195 DESCRIPTION: Psf Requests could allow a local authenticated attacker to bypass security restrictions, caused by an incorre...

GHSA-G8M5-722R-8WHQ vulnerabilities

Vulnerabilities for packages: zookeeper, celeborn, confluent-kafka, druid, solr, spark, zookeeper-fips, cassandra-reaper, strimzi-kafka-operator, spark-fips, apache-tika, confluent-kafka-jre-bcfips, apache-nifi, kafka, cloudwatch-exporter...

CVE-2024-8184 vulnerabilities

Vulnerabilities for packages: zookeeper, celeborn, confluent-kafka, druid, solr, spark, zookeeper-fips, cassandra-reaper, strimzi-kafka-operator, spark-fips, apache-tika, confluent-kafka-jre-bcfips, apache-nifi, kafka, cloudwatch-exporter...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities (CVE-2017-5637, CVE-2019-0201, CVE-2018-8012, CVE-2023-44981)

Summary IBM Security Guardium uses Apache ZooKeeper as a component. This component has multiple vulnerabilities which might affect the product. These vulnerabilities have been addressed in an update. Vulnerability Details CVEID:CVE-2017-5637 DESCRIPTION: Apache Zookeeper is vulnerable to a denial...

GHSA-78WR-2P64-HPWJ vulnerabilities

Vulnerabilities for packages: logstash, sonarqube-10, kserve, celeborn, confluent-common-docker, apache-nifi, opensearch, sonarqube, strimzi-kafka-operator, confluent-kafka, kserve-modelmesh, wildfly, management-api-for-apache-cassandra-5.0, zookeeper...

GHSA-78WR-2P64-HPWJ vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, hadoop-fips, sonarqube, hadoop-client-modules, confluent-kafka-jre-bcfips, kafka, management-api-for-apache-cassandra-5.0, opensearch, zookeeper, confluent-common-docker, confluent-kafka, druid, logstash, wildfly, sonarqube-10, celeborn,...

CVE-2024-47554 vulnerabilities

Vulnerabilities for packages: logstash, sonarqube-10, kserve, celeborn, confluent-common-docker, apache-nifi, opensearch, sonarqube, strimzi-kafka-operator, confluent-kafka, kserve-modelmesh, wildfly, management-api-for-apache-cassandra-5.0, zookeeper...

CVE-2024-47554 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, hadoop-fips, sonarqube, hadoop-client-modules, confluent-kafka-jre-bcfips, kafka, management-api-for-apache-cassandra-5.0, opensearch, zookeeper, confluent-common-docker, confluent-kafka, druid, logstash, wildfly, sonarqube-10, celeborn,...

Security Bulletin: Vulnerabilities in Apache ZooKeeper affect IBM watsonx.data

Summary Apache ZooKeeper could allow a remote authenticated attacker to obtain sensitive information or allow a remote attacker to bypass security restrictions. These can affect IBM watsonx.data. Vulnerability Details CVEID:CVE-2024-23944 DESCRIPTION: Apache ZooKeeper could allow a remote...

Security Bulletin: Potential Vulnerability in Apache Solr and Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis (CVE-2022-24823)

Summary There is a potential Netty vulnerability in Apache Solr and Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis. This has been fixed Vulnerability Details CVEID:CVE-2022-24823 DESCRIPTION: Netty could allow a local authenticated attacker to obtain sensitive information,...

Apache-ZooKeeper: Apache ZooKeeper: Information disclosure in persistent watcher handling

A flaw was found in the Apache Zookeeper package. Affected versions of this package are vulnerable to Information Exposure due to a missing ACL check in the handling of persistent watchers. An attacker can monitor child znodes by attaching a persistent watcher addWatch command to a parent node th...

Moderate: Red Hat Security Advisory: Red Hat AMQ Streams 2.5.2 release and security update

Red Hat AMQ Streams 2.5.2 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Security Bulletin: Multiple vulnerabilities in Netty affect Apache Solr, Apache Zookeeper and Logstash shipped with IBM Operations Analytics - Log Analysis

Summary There are vulnerabilities in various versions of Netty that affect Apache Solr, Apache Zookeeper and Logstash. The vulnerabilities are in Vulnerability Details section Vulnerability Details CVEID:CVE-2019-20444 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw i...

Apache ZooKeeper Information Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache ZooKeeper Information Disclosure', 'Description' = %q Apache ZooKeeper server service runs on TCP 2181 and by default, it is accessible...