CVE-2024-51504

An authentication bypass vulnerability was found in Apache Zookeeper. The default configuration of the client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication by spoofing the client's IP address in request...

Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

GHSA-G93M-8X6H-G5GV Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

DEBIAN-CVE-2024-51504

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

UBUNTU-CVE-2024-51504

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504

CVE-2024-51504 affects ZooKeeper Admin Server via IPAuthenticationProvider. Default IP detection uses HTTP headers (X-Forwarded-For) and can be spoofed, leading to authentication bypass for IP-based auth. Admin commands like snapshot/restore may be exploited after bypass. Impact: potential inform...

CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

CVE-2024-51504

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which...

Apache Zookeeper 安全漏洞

Apache ZooKeeper is a centralized service under the Apache Software Foundation for maintaining configuration information, naming, providing distributed synchronization, and providing group services. An authentication bypass vulnerability exists in Apache ZooKeeper versions prior to 3.9.3. The...

PT-2024-7913

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.9.0 through 3.9.2 Description The issue is related to the IPAuthenticationProvider in the ZooKeeper Admin Server, which allows for authentication bypass via spoofing. This impacts IP-based authentication and is due ...

Security Bulletin: IBM Observability with Instana using third-party Kubernetes Operators is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana using third-party Kubernetes Operators build 283 Vulnerability Details CVEID:CVE-2024-35195 DESCRIPTION: Psf Requests could allow a local authenticated attacker to bypass security restrictions, caused by an incorre...

GHSA-G8M5-722R-8WHQ vulnerabilities

Vulnerabilities for packages: spark, apache-tika, confluent-kafka, strimzi-kafka-operator, cloudwatch-exporter, confluent-kafka-jre-bcfips, kafka, solr, zookeeper, zookeeper-fips, druid, celeborn, apache-nifi, cassandra-reaper, spark-fips...

CVE-2024-8184 vulnerabilities

Vulnerabilities for packages: spark, apache-tika, confluent-kafka, strimzi-kafka-operator, cloudwatch-exporter, confluent-kafka-jre-bcfips, kafka, solr, zookeeper, zookeeper-fips, druid, celeborn, apache-nifi, cassandra-reaper, spark-fips...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities (CVE-2017-5637, CVE-2019-0201, CVE-2018-8012, CVE-2023-44981)

Summary IBM Security Guardium uses Apache ZooKeeper as a component. This component has multiple vulnerabilities which might affect the product. These vulnerabilities have been addressed in an update. Vulnerability Details CVEID:CVE-2017-5637 DESCRIPTION: Apache Zookeeper is vulnerable to a denial...

GHSA-78WR-2P64-HPWJ vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator, druid, apache-nifi, hadoop-client-modules, sonarqube, confluent-kafka, opensearch, zookeeper-fips, kafka, confluent-common-docker, hadoop-fips, management-api-for-apache-cassandra-5.0, wildfly, sonarqube-10, zookeeper,...

GHSA-78WR-2P64-HPWJ vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, sonarqube-10, wildfly, management-api-for-apache-cassandra-5.0, celeborn, confluent-kafka, zookeeper, confluent-common-docker, logstash, druid, apache-nifi, strimzi-kafka-operator, sonarqube, kserve, opensearch...

CVE-2024-47554 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, strimzi-kafka-operator, druid, apache-nifi, hadoop-client-modules, sonarqube, confluent-kafka, opensearch, zookeeper-fips, kafka, confluent-common-docker, hadoop-fips, management-api-for-apache-cassandra-5.0, wildfly, sonarqube-10, zookeeper,...