PT-2025-39239 · Apache+2 · Apache Zookeeper+2

Damien Diederen · Published 2025-09-24 · Updated 2026-04-10 · CVE-2025-58457

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 3.9.0 through 3.9.3

Description An improper permission check exists in the ZooKeeper AdminServer, allowing authorized clients to execute snapshot and restore commands with insufficient permissions. The issue can be mitigated by disabling the snapshot and restore commands via admin.snapshot.enabled and admin.restore.enabled, disabling the entire AdminServer interface via admin.enableServer, or ensuring the root Access Control List (ACL) does not provide open permissions. ZooKeeper ACLs are not recursive, meaning this does not impact operations on child nodes beyond notifications from recursive watches.

Recommendations Upgrade to version 3.9.4. Disable the snapshot and restore commands via admin.snapshot.enabled and admin.restore.enabled. Disable the AdminServer interface via admin.enableServer. Ensure the root ACL does not provide open permissions.

Fix

Weakness Enumeration

CWE-280

Related Identifiers

BDU:2025-12605

BIT-ZOOKEEPER-2025-58457

CVE-2025-58457

GHSA-2HMJ-97JW-28JH

Affected Products

Apache Zookeeper

Debian

Red Os

References · 30

• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/BIT-zookeeper-2025-58457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58457 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58457 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2025-58457 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-58457 · Security Note
• https://lists.apache.org/thread/r5yol0kkhx2fzw22pxk1ozwm3oc6yxrx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hmj-97jw-28jh · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-58457 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12605 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-58457 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-58457 · Vendor Advisory
• https://github.com/apache/zookeeper · Note
• https://access.redhat.com/security/cve/cve-2025-58457 · Note