PT-2018-3087 · Apache+2 · Apache Zookeeper+2

Published 2018-05-21 · Updated 2024-08-15 · CVE-2018-8012

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.5.0-alpha through 3.5.3-beta Apache ZooKeeper versions prior to 3.4.10

Description The issue arises from the lack of authentication when a server attempts to join a quorum in Apache ZooKeeper. This allows an arbitrary endpoint to join the cluster and propagate counterfeit changes to the leader. An attacker could exploit this to write arbitrary files to the operating system of a vulnerable device.

Recommendations For Apache ZooKeeper versions prior to 3.4.10, update to version 3.4.10 or later. For Apache ZooKeeper versions 3.5.0-alpha through 3.5.3-beta, update to a version later than 3.5.3-beta. As a temporary workaround, consider restricting access to the quorum to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2019-03811

CVE-2018-8012

DSA-4214-1

GHSA-CCQF-C5HQ-77MP

USN-4789-1

Affected Products

Apache Zookeeper

Red Os

Ubuntu

References · 54

• https://oracle.com/security-alerts/cpujul2020.html · Patch
• https://bdu.fstec.ru/vul/2024-06489 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5017 · Security Note
• https://ubuntu.com/security/CVE-2018-8012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8012 · Security Note
• https://bdu.fstec.ru/vul/2022-04726 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8012 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/zookeeper · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5017 · Vendor Advisory
• https://debian.org/security/2018/dsa-4214 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-8012 · Security Note
• https://osv.dev/vulnerability/GHSA-ccqf-c5hq-77mp · Vendor Advisory
• https://osv.dev/vulnerability/USN-4789-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5637 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-8012 · Vendor Advisory