PT-2023-6096

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.7.2 Apache ZooKeeper versions prior to 3.8.3 Apache ZooKeeper versions prior to 3.9.1 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeepe...

K94504224: Apache ZooKeeper vulnerability CVE-2019-0201

Security Advisory Description An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeepers getACL command doesnt check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string...

SUSE CVE-2017-5637

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10,...

SUSE CVE-2018-8012

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader...

Security Bulletin: Multiple Vulnerabilities discovered in libraries used by Apache Zookeeper that is included in ITNM (CVE-2020-36518, CVE-2022-2047, CVE-2022-2048, CVE-2022-24823)

Summary Multiple vulnerabilities CVE-2020-36518; CVE-2022-2047; CVE-2022-2048; CVE-2022-24823 found in apache zookeeper used by IBM Tivoli Network Manager ITNM IP Edition. The fix contains the updated versions of corresponding libraries. Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION:...

Security Bulletin: IBM Sterling Global Mailbox vulnerable to security bypass due to Apache Zookeeper (CVE-2020-10663)

Summary IBM Sterling Global Mailbox has addressed a security bypass issue in Apache Zookeeper. Vulnerability Details CVEID:CVE-2020-10663 DESCRIPTION: RubyGems JSON gem for Ruby could allow a remote attacker to bypass security restrictions, caused by improper validation of input by the gem when...

Oracle Primavera Unifier (Oct 2022 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Document Management Apache Solr. Supported...

Security Bulletin: IBM Sterling B2B Integrator B2B API vulnerable to multiple issues due to Apache Zookeeper (CVE-2019-0201, CVE-2021-21409)

Summary IBM Sterling B2B Integrator has addressed the security vulnerabilities in Apache Zookeeper. Vulnerability Details CVEID:CVE-2019-0201 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to obtain sensitive information, caused by the failure to check permissions by the getACL...

GHSA-H259-3RJG-5QP3 Exposure of Sensitive Information to an Unauthorized Actor in JBoss Fuse

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text:...

Exposure of Sensitive Information to an Unauthorized Actor in JBoss Fuse

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text:...

GHSA-7CWJ-J333-X7F7 Uncontrolled Resource Consumption in Apache ZooKeeper

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10,...

Uncontrolled Resource Consumption in Apache ZooKeeper

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10,...

at.salzburgresearch.nodekeeper:nodekeeper-java (>=1.0 <=1.2), ca.innovativemedicine:vcfimp-solr_2.10 (=0.7.0) +759 more potentially affected by CVE-2018-8012 via org.apache.zookeeper:zookeeper (>=3.3.0 <=3.4.1)

org.apache.zookeeper:zookeeper MAVEN version =3.3.0, =1.0, =0.2, =2.0.0, =1.0.0.RELEASE, =2.0.10, =2.5, =2.5, =2.6.11, =2.6.20, =5.0.1.5, =5.0.2, =6.5.5 - com.boozallen.cognition:cognition-spark-common =0.4.0 and more Source cves: CVE-2018-8012 Source advisory: OSV:GHSA-CCQF-C5HQ-77MP...

Missing Authorization in Apache ZooKeeper

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader...

Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities

Summary The Planning Analytics Workspace component of IBM Planning Analytics is affected by vulnerabilities These have been addressed in IBM Planning Analytics Local v2.0 - Planning Analytics Workspace Release 68. Vulnerability Details CVEID: CVE-2019-10086 DESCRIPTION: Apache Commons Beanutils...

Log Analysis Security Bulletin List

Question Is there a list of security bulletins that describe resolved vulnerabilities affecting Log Analysis? Answer Log Analysis is made up of several components. The following table contains security bulletins that address the vulnerability of various components in Log Analysis, listed by...

Security Bulletin: Vulnerability in jersey affect Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis (CVE-2014-3643)

Summary There is a potential XXE vulnerability in jersey that affects Apache Zookeeper Vulnerability Details CVEID: CVE-2014-3643 DESCRIPTION: Jersey could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data by jersey SAX...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Apache Zookeeper vulnerability (CVE-2019-0201)

Summary IBM Operations Analytics - Log Analysis has addressed a potential permission vulnerability in Apache ZooKeeper. Vulnerability Details CVEID: CVE-2019-0201 DESCRIPTION: Apache ZooKeeper could allow a remote attacker to obtain sensitive information, caused by the failure to check permission...

USN-4789-1: Apache ZooKeeper vulnerabilities

It was discovered that Apache ZooKeeper incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. CVE-2016-5017 It was discovered that Apache ZooKeeper incorrectly implemented "wchp/wchc" commands. An attacker could...

Apache ZooKeeper Information Disclosure

Apache ZooKeeper server service runs on TCP 2181 and by default, it is accessible without any authentication. This module targets Apache ZooKeeper service instances to extract information about the system environment, and service statistics. Module Options msf use...