CVE-2018-8012
Fixed in a distro release EPSS 8%
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Products: Apache Software Foundation Apache ZooKeeper
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.zookeeper:zookeeper | 3.4.10 |
| Maven | org.apache.zookeeper:zookeeper | 3.5.4-beta |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | zookeeper | 3.4.10-2 |
| Debian:13 | zookeeper | 3.4.10-2 |
| Debian:14 | zookeeper | 3.4.10-2 |
| Debian:8 | zookeeper | 3.4.9-3+deb8u1 |
| Debian:9 | zookeeper | 3.4.9-3+deb9u1 |
| Ubuntu:Pro:14.04:LTS | zookeeper | no fix |
| Ubuntu:Pro:14.04:LTS | zookeeper | 3.4.5+dfsg-1ubuntu0.1~esm1 |
| Ubuntu:Pro:16.04:LTS | zookeeper | 3.4.8-1ubuntu0.1~esm1 |