CVE-2018-8012 Missing Authorization in Apache ZooKeeper
HighCVSS 7.5
EPSS 8.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.zookeeper/zookeeper(Maven) | <= 3.4.9 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | >= 3.5.0-alpha, <= 3.5.3-beta | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | < 3.4.10 | 3.4.10 |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.0 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.1 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.2 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.3 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.4 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.5 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.6 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.0 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.1 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.2 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.3 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.4 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.5 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.6 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.7 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.8 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.9 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | >= 3.5.0-alpha, < 3.5.4-beta | 3.5.4-beta |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.0-alpha | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.1-alpha | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.2-alpha | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.3-beta | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/zookeeper(Debian:12) | < 3.4.10-2 | 3.4.10-2 |
| debian/zookeeper(Debian:13) | < 3.4.10-2 | 3.4.10-2 |
| debian/zookeeper(Debian:14) | < 3.4.10-2 | 3.4.10-2 |
| apache zookeeper | < 3.4.10 | 3.4.10 |
| apache zookeeper | >= 3.5.0, <= 3.5.3 | No fix listed |
| apache zookeeper | = 3.5.0-alpha | No fix listed |
| apache zookeeper | = 3.5.3-beta | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| oracle GoldenGate Stream Analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| Apache ZooKeeper | = Apache ZooKeeper prior to 3.4.10, Apache ZooKeeper 3.5.0-alpha through 3.5.3-beta | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- DSA-4214 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- 104253 third-party-advisory vdb-entry
- 1040948 third-party-advisory vdb-entry
- github.com
- Debian Security Tracker CVE-2018-8012 vendor-advisory
- bugs.debian.org issue-tracking
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- lists.apache.org
- [jackrabbit-oak-commits] 20210720 [jackrabbit-oak] branch trunk updated: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 (#326) mailing-list
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 opened a new pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 mailing-list
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 commented on pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 mailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- [jackrabbit-dev] 20210720 [GitHub] [jackrabbit-oak] nit0906 merged pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 mailing-list