PT-2023-6096 · Apache+3 · Apache Zookeeper+3

Damien Diederen · Publicado 2023-10-02 · Atualizado 2026-05-18 · CVE-2023-44981

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.7.2 Apache ZooKeeper versions prior to 3.8.3 Apache ZooKeeper versions prior to 3.9.1

Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled, the authorization check can be skipped if the instance part in the SASL authentication ID is missing. This allows an arbitrary endpoint to join the cluster and propagate counterfeit changes to the leader, giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.

Recommendations To resolve the issue, upgrade to version 3.7.2, 3.8.3, or 3.9.1, which fixes the issue. Alternatively, ensure the ensemble election/quorum communication is protected by a firewall to mitigate the issue.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

BDU:2023-06799

BIT-ZOOKEEPER-2023-44981

CLEANSTART-2026-JU62349

CLEANSTART-2026-SQ91016

CLEANSTART-2026-SV95049

CLEANSTART-2026-WK99982

CVE-2023-44981

DLA-3624-1

DSA-5544-1

GHSA-7286-PGFV-VXVH

USN-6559-1

Produtos afetados

Apache Zookeeper

Linuxmint

Red Os

Ubuntu

Referências · 178

• https://github.com/apache/zookeeper · Nota
• https://github.com/apache/zookeeper/commit/96b3172ca249a8580e9a315d589d319286cee4ee · Nota
• https://github.com/apache/zookeeper/commit/e2070bed85d8b0c98a5a0045bf92421f473c412e · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JU62349.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WK99982.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SQ91016.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SV95049.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-3510 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-40167 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-3624-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-3171 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2022-2047 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Nota de Segurança
• https://security.netapp.com/advisory/ntap-20240621-0007 · Nota