Patchwire CVEs, their patch status, and feeds to follow them

CVE-2023-44981

Fixed in a distro release EPSS 2%CVSS 9.1

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue. See the documentation for more details on correct cluster administration.

Published 2023-10-11 · CVE record · OSV

Products: Apache Software Foundation Apache ZooKeeper

Fixed upstream

EcosystemPackageFixed in
Mavenorg.apache.zookeeper:zookeeper3.7.2
Mavenorg.apache.zookeeper:zookeeper3.8.3
Mavenorg.apache.zookeeper:zookeeper3.9.1

Distro releases

ReleasePackageFixed in
Chainguardkafka3.6.0-r4
Chainguardkafka-bitnami-compat3.6.0-r4
Chainguardtrino478-r2
Chainguardtrino-config478-r2
Chainguardtrino-oci-entrypoint478-r2
Chainguardtrino-plugin-ai-functions478-r2
Chainguardtrino-plugin-bigquery478-r2
Chainguardtrino-plugin-blackhole478-r2
Chainguardtrino-plugin-cassandra478-r2
Chainguardtrino-plugin-clickhouse478-r2
Chainguardtrino-plugin-delta-lake478-r2
Chainguardtrino-plugin-druid478-r2
Chainguardtrino-plugin-duckdb478-r2
Chainguardtrino-plugin-elasticsearch478-r2
Chainguardtrino-plugin-exasol478-r2
Chainguardtrino-plugin-exchange-filesystem478-r2
Chainguardtrino-plugin-exchange-hdfs478-r2
Chainguardtrino-plugin-faker478-r2
Chainguardtrino-plugin-functions-python478-r2
Chainguardtrino-plugin-geospatial478-r2
Chainguardtrino-plugin-google-sheets478-r2
Chainguardtrino-plugin-hive478-r2
Chainguardtrino-plugin-http-event-listener478-r2
Chainguardtrino-plugin-hudi478-r2
Chainguardtrino-plugin-iceberg478-r2
Chainguardtrino-plugin-ignite478-r2
Chainguardtrino-plugin-jmx478-r2
Chainguardtrino-plugin-kafka478-r2
Chainguardtrino-plugin-kafka-event-listener478-r2
Chainguardtrino-plugin-lakehouse478-r2
Chainguardtrino-plugin-ldap-group-provider478-r2
Chainguardtrino-plugin-loki478-r2
Chainguardtrino-plugin-mariadb478-r2
Chainguardtrino-plugin-memory478-r2
Chainguardtrino-plugin-ml478-r2
Chainguardtrino-plugin-mongodb478-r2
Chainguardtrino-plugin-mysql478-r2
Chainguardtrino-plugin-mysql-event-listener478-r2
Chainguardtrino-plugin-opa478-r2
Chainguardtrino-plugin-openlineage478-r2
Chainguardtrino-plugin-opensearch478-r2
Chainguardtrino-plugin-oracle478-r2
Chainguardtrino-plugin-password-authenticators478-r2
Chainguardtrino-plugin-pinot478-r2
Chainguardtrino-plugin-postgresql478-r2
Chainguardtrino-plugin-prometheus478-r2
Chainguardtrino-plugin-ranger478-r2
Chainguardtrino-plugin-redis478-r2
Chainguardtrino-plugin-redshift478-r2
Chainguardtrino-plugin-resource-group-managers478-r2
Chainguardtrino-plugin-session-property-managers478-r2
Chainguardtrino-plugin-singlestore478-r2
Chainguardtrino-plugin-snowflake478-r2
Chainguardtrino-plugin-spooling-filesystem478-r2
Chainguardtrino-plugin-sqlserver478-r2
Chainguardtrino-plugin-teradata-functions478-r2
Chainguardtrino-plugin-thrift478-r2
Chainguardtrino-plugin-tpcds478-r2
Chainguardtrino-plugin-tpch478-r2
Chainguardtrino-plugin-vertica478-r2
Debian 10zookeeper3.4.13-2+deb10u1
Debian 11zookeeper3.4.13-6+deb11u1
Debian 12zookeeper3.8.0-11+deb12u1
Debian 13zookeeper3.9.1-1
Debian 14zookeeper3.9.1-1
Ubuntu 20.04 LTSzookeeper3.4.13-5ubuntu0.1
Ubuntu 22.04 LTSzookeeper3.4.13-6ubuntu4.1
Ubuntu Pro 14.04 LTSzookeeper3.4.5+dfsg-1ubuntu0.1~esm3
Ubuntu Pro 16.04 LTSzookeeper3.4.8-1ubuntu0.1~esm2
Ubuntu Pro 18.04 LTSzookeeper3.4.13-3ubuntu0.1~esm1
Wolfikafka3.6.0-r4
Wolfikafka-bitnami-compat3.6.0-r4
Wolfitrino478-r2
Wolfitrino-config478-r2
Wolfitrino-oci-entrypoint478-r2
Wolfitrino-plugin-ai-functions478-r2
Wolfitrino-plugin-bigquery478-r2
Wolfitrino-plugin-blackhole478-r2
Wolfitrino-plugin-cassandra478-r2
Wolfitrino-plugin-clickhouse478-r2
Wolfitrino-plugin-delta-lake478-r2
Wolfitrino-plugin-druid478-r2
Wolfitrino-plugin-duckdb478-r2
Wolfitrino-plugin-elasticsearch478-r2
Wolfitrino-plugin-exasol478-r2
Wolfitrino-plugin-exchange-filesystem478-r2
Wolfitrino-plugin-exchange-hdfs478-r2
Wolfitrino-plugin-faker478-r2
Wolfitrino-plugin-functions-python478-r2
Wolfitrino-plugin-geospatial478-r2
Wolfitrino-plugin-google-sheets478-r2
Wolfitrino-plugin-hive478-r2
Wolfitrino-plugin-http-event-listener478-r2
Wolfitrino-plugin-hudi478-r2
Wolfitrino-plugin-iceberg478-r2
Wolfitrino-plugin-ignite478-r2
Wolfitrino-plugin-jmx478-r2
Wolfitrino-plugin-kafka478-r2
Wolfitrino-plugin-kafka-event-listener478-r2
Wolfitrino-plugin-lakehouse478-r2
Wolfitrino-plugin-ldap-group-provider478-r2
Wolfitrino-plugin-loki478-r2
Wolfitrino-plugin-mariadb478-r2
Wolfitrino-plugin-memory478-r2
Wolfitrino-plugin-ml478-r2
Wolfitrino-plugin-mongodb478-r2
Wolfitrino-plugin-mysql478-r2
Wolfitrino-plugin-mysql-event-listener478-r2
Wolfitrino-plugin-opa478-r2
Wolfitrino-plugin-openlineage478-r2
Wolfitrino-plugin-opensearch478-r2
Wolfitrino-plugin-oracle478-r2
Wolfitrino-plugin-password-authenticators478-r2
Wolfitrino-plugin-pinot478-r2
Wolfitrino-plugin-postgresql478-r2
Wolfitrino-plugin-prometheus478-r2
Wolfitrino-plugin-ranger478-r2
Wolfitrino-plugin-redis478-r2
Wolfitrino-plugin-redshift478-r2
Wolfitrino-plugin-resource-group-managers478-r2
Wolfitrino-plugin-session-property-managers478-r2
Wolfitrino-plugin-singlestore478-r2
Wolfitrino-plugin-snowflake478-r2
Wolfitrino-plugin-spooling-filesystem478-r2
Wolfitrino-plugin-sqlserver478-r2
Wolfitrino-plugin-teradata-functions478-r2
Wolfitrino-plugin-thrift478-r2
Wolfitrino-plugin-tpcds478-r2
Wolfitrino-plugin-tpch478-r2
Wolfitrino-plugin-vertica478-r2