Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

GHSA-7286-pgfv-vxvh

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
Back to all
CVE

GHSA-7286-pgfv-vxvh

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.

Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.

Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

See the documentation for more details on correct cluster administration.

Package Versions Affected

Package Version
patch Availability
Available
Unavailable
Available
Unavailable
org.apache.zookeeper:zookeeper 3.9.0
Available
Unavailable

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Related Resources

No items found.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-44981, https://github.com/apache/zookeeper, https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b, https://lists.debian.org/debian-lts-announce/2023/10/msg00029.html, https://security.netapp.com/advisory/ntap-20240621-0007, https://www.debian.org/security/2023/dsa-5544, http://www.openwall.com/lists/oss-security/2023/10/11/4

Severity

9.1

CVSS Score
0
10

Basic Information

Ecosystem
Base CVSS
9.1
EPSS Probability
0.00027%
EPSS Percentile
0.0719%
Introduced Version
3.7.0,3.8.0,3.9.0,3.4.10,3.5.4-beta
Fix Available
3.7.2,3.8.3,3.9.1

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading