Access control bypass in Apache ZooKeeper

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

Information Disclosure

Apache ZooKeeper is affected by unauthorized information disclosure. getACL command does not check permissions when retrieving the ACLs of the requested node. Consequently, plaintext information contained in the ACL Id field is returned. This allows an attacker to retrieve users' Id and...

CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

DEBIAN-CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

Design/Logic Flaw

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

CVE-2019-0201

CVE-2019-0201 affects Apache ZooKeeper up to versions 3.4.13 and 3.5.4-beta, where getACL() does not enforce permissions and returns the ACL Id in plaintext. When Digest Authentication is in use, the unsalted hash value contained in the Id field can be disclosed to unauthenticated or unprivileged...

CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider...

Apache Zookeeper Information Disclosure Vulnerability

Apache Zookeeper is able to provide open source distributed configuration services for large-scale distributed computing , synchronization services and naming registry and other functions . Apache Zookeeper suffers from an information disclosure vulnerability that allows remote attackers to explo...

Security Bulletin: InfoSphere Data Replication is affected by an Apache ZooKeeper open source library vulnerability

Summary InfoSphere Data Replication has addressed the following vulnerability: CVE-2018-8012 - Apache Zookeeper could allow a remote attacker to bypass security restrictions, caused by the failure to enforce authentication or authorization when a server attempts to join a quorum. An attacker coul...

Security Bulletin: IBM Security Guardium is affected by a public disclosed vulnerability from Apache ZooKeeper

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-8012 DESCRIPTION: Apache Zookeeper could allow a remote attacker to bypass security restrictions, caused by the failure to enforce authentication or authorization when a server attempts ...

Security Bulletin: IBM QRadar Incident Forensics is vulnerable to Public disclosed vulnerability from Apache ZooKeeper (CVE-2018-8012)

Summary Public disclosed vulnerability from Apache ZooKeeper Vulnerability Details CVEID: CVE-2018-8012 Description: Apache Zookeeper could allow a remote attacker to bypass security restrictions, caused by the failure to enforce authentication or authorization when a server attempts to join a...

Security Bulletin: A Security Vulnerability affects IBM® Cloud Private (‪CVE-2018-8012)‬‬‬

Summary IBM Cloud Private is vulnerable to a security vulnerability Vulnerability Details CVEID: CVE-2018-8012 DESCRIPTION: Apache Zookeeper could allow a remote attacker to bypass security restrictions, caused by the failure to enforce authentication or authorization when a server attempts to jo...

Security Bulletin:Open Source Apache Zookeeper Vulnerabilities in IBM eDiscovery Analyzer

Summary Apache ZooKeeper is vulnerable to a buffer overflow, caused by improper bounds checking by the C client shells "clist" and "climt". By sending an overly long command, a attacker could overflow a buffer and execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2016-5017...

Security Bulletin: Multi-Cloud Data Encryption (MDE) is using components with Known Vulnerabilities

Summary Multi-Cloud Data Encryption MDE has addressed the following vulnerability: Using components with known vulnerabilities Vulnerability Details CVEID: CVE-2017-5637 DESCRIPTION: Apache Zookeeper is vulnerable to a denial of service, caused by the improper handling of the wchp command. By...

Apache Zookeeper Server Detection

The remote host is running an Apache Zookeeper server. TRUSTED...

Apache Zookeeper x < 3.4.10 / 3.5.x < 3.5.4 Missing Authentication Remote Quorum Joining Vulnerability

The instance of Apache Zookeeper listening on the remote host is either running a version that does not support quorum authentication or has not been configured to use quorum authentication. This may allow a remote attacker to join a cluster quorum and begin propagating counterfeit changes to the...

CVE-2018-8012

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader...