Apache Zookeeper any version

Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication

Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string.

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

Apache ZooKeeper: Information disclosure in persistent watcher handling

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands