Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-58457

Fixed in a distro release EPSS <1%CVSS 4.3

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by disabling both commands (via admin.snapshot.enabled and admin.restore.enabled), disabling the whole AdminServer interface (via admin.enableServer), or ensuring that the root ACL does not provide open permissions. (Note that ZooKeeper ACLs are not recursive, so this does not impact operations on child nodes besides notifications from recursive watches.)

Published 2025-09-24 · CVE record · OSV

Products: Apache Software Foundation Apache ZooKeeper

Fixed upstream

EcosystemPackageFixed in
Mavenorg.apache.zookeeper:zookeeper3.9.4

Distro releases

ReleasePackageFixed in
Chainguardapache-activemq-artemis2.42.0-r9
Chainguardapache-activemq-artemis-compat2.42.0-r9
Chainguardapache-pulsar4.1.0-r1
Chainguardapache-pulsar-compat4.1.0-r1
Chainguardkafka-strimzi-compat0.47.0-r8
Chainguardkafka_exporter-strimzi-compat0.47.0-r8
Chainguardprometheus-jmx-exporter-strimzi-compat0.47.0-r8
Chainguardpyspark-scala-2.133.5.7-r2
Chainguardsolr9.9.0-r3
Chainguardsolr-oci-compat9.9.0-r3
Chainguardspark-3.53.5.7-r2
Chainguardspark-3.5-bitnami-compat3.5.7-r2
Chainguardspark-3.5-compat3.5.7-r2
Chainguardspark-3.5-minimal3.5.7-r2
Chainguardspark-3.5-minimal-openjdk-113.5.7-r2
Chainguardspark-3.5-minimal-openjdk-173.5.7-r2
Chainguardspark-3.5-minimal-openjdk-83.5.7-r2
Chainguardspark-3.5-openjdk-113.5.7-r2
Chainguardspark-3.5-openjdk-173.5.7-r2
Chainguardspark-3.5-openjdk-83.5.7-r2
Chainguardspark-3.5-scala-2.123.5.7-r2
Chainguardspark-3.5-scala-2.12-bitnami-compat3.5.7-r2
Chainguardspark-3.5-scala-2.12-compat3.5.7-r2
Chainguardspark-3.5-scala-2.12-iamguarded-compat3.5.7-r2
Chainguardspark-3.5-scala-2.12-minimal-openjdk-113.5.7-r2
Chainguardspark-3.5-scala-2.12-minimal-openjdk-173.5.7-r2
Chainguardspark-3.5-scala-2.12-minimal-openjdk-83.5.7-r2
Chainguardspark-3.5-scala-2.12-openjdk-113.5.7-r2
Chainguardspark-3.5-scala-2.12-openjdk-173.5.7-r2
Chainguardspark-3.5-scala-2.12-openjdk-83.5.7-r2
Chainguardspark-3.5-scala-2.133.5.7-r2
Chainguardspark-3.5-scala-2.13-compat3.5.7-r2
Chainguardspark-3.5-scala-2.13-openjdk-113.5.7-r2
Chainguardspark-3.5-scala-2.13-openjdk-173.5.7-r2
Chainguardspark-3.5-scala-2.13-openjdk-83.5.7-r2
Chainguardspark-4.04.0.1-r1
Chainguardspark-4.0-scala-2.134.0.1-r1
Chainguardspark-4.0-scala-2.13-compat4.0.1-r1
Chainguardspark-fips-3.53.5.4-r17
Chainguardspark-fips-3.5-scala-2.123.5.4-r17
Chainguardspark-fips-3.5-scala-2.12-compat3.5.4-r17
Chainguardspark-fips-3.5-scala-2.133.5.4-r17
Chainguardspark-fips-3.5-scala-2.13-compat3.5.4-r17
Chainguardstrimzi-kafka-operator0.47.0-r8
Chainguardstrimzi-kafka-operator-cluster-operator0.47.0-r8
Chainguardstrimzi-kafka-operator-kafka-agent0.47.0-r8
Chainguardstrimzi-kafka-operator-kafka-agent-30.47.0-r8
Chainguardstrimzi-kafka-operator-kafka-base0.47.0-r8
Chainguardstrimzi-kafka-operator-kafka-init0.47.0-r8
Chainguardstrimzi-kafka-operator-kafka-thirdparty-libs0.47.0-r8
Chainguardstrimzi-kafka-operator-kafka-thirdparty-libs-cc0.47.0-r8
Chainguardstrimzi-kafka-operator-mirror-maker-agent0.47.0-r8
Chainguardstrimzi-kafka-operator-topic-operator0.47.0-r8
Chainguardstrimzi-kafka-operator-tracing-agent0.47.0-r8
Chainguardstrimzi-kafka-operator-user-operator0.47.0-r8
Chainguardthingsboard4.2-r7
Chainguardthingsboard-tb-js-executor4.2-r7
Chainguardthingsboard-tb-mqtt-transport4.2-r7
Chainguardthingsboard-tb-node4.2-r7
Chainguardthingsboard-tb-web-ui4.2-r7
Chainguardtrino476-r9
Chainguardtrino-config476-r9
Chainguardtrino-oci-entrypoint476-r9
Chainguardtrino-plugin-accumulo476-r9
Chainguardtrino-plugin-ai-functions476-r9
Chainguardtrino-plugin-atop476-r9
Chainguardtrino-plugin-bigquery476-r9
Chainguardtrino-plugin-blackhole476-r9
Chainguardtrino-plugin-cassandra476-r9
Chainguardtrino-plugin-clickhouse476-r9
Chainguardtrino-plugin-delta-lake476-r9
Chainguardtrino-plugin-druid476-r9
Chainguardtrino-plugin-duckdb476-r9
Chainguardtrino-plugin-elasticsearch476-r9
Chainguardtrino-plugin-example-http476-r9
Chainguardtrino-plugin-exasol476-r9
Chainguardtrino-plugin-exchange-filesystem476-r9
Chainguardtrino-plugin-exchange-hdfs476-r9
Chainguardtrino-plugin-faker476-r9
Chainguardtrino-plugin-functions-python476-r9
Chainguardtrino-plugin-geospatial476-r9
Chainguardtrino-plugin-google-sheets476-r9
Chainguardtrino-plugin-hive476-r9
Chainguardtrino-plugin-http-event-listener476-r9
Chainguardtrino-plugin-http-server-event-listener476-r9
Chainguardtrino-plugin-hudi476-r9
Chainguardtrino-plugin-iceberg476-r9
Chainguardtrino-plugin-ignite476-r9
Chainguardtrino-plugin-jmx476-r9
Chainguardtrino-plugin-kafka476-r9
Chainguardtrino-plugin-kafka-event-listener476-r9
Chainguardtrino-plugin-kinesis476-r9
Chainguardtrino-plugin-kudu476-r9
Chainguardtrino-plugin-lakehouse476-r9
Chainguardtrino-plugin-ldap-group-provider476-r9
Chainguardtrino-plugin-local-file476-r9
Chainguardtrino-plugin-loki476-r9
Chainguardtrino-plugin-mariadb476-r9
Chainguardtrino-plugin-memory476-r9
Chainguardtrino-plugin-ml476-r9
Chainguardtrino-plugin-mongodb476-r9
Chainguardtrino-plugin-mysql476-r9
Chainguardtrino-plugin-mysql-event-listener476-r9
Chainguardtrino-plugin-opa476-r9
Chainguardtrino-plugin-openlineage476-r9
Chainguardtrino-plugin-opensearch476-r9
Chainguardtrino-plugin-oracle476-r9
Chainguardtrino-plugin-password-authenticators476-r9
Chainguardtrino-plugin-phoenix5476-r9
Chainguardtrino-plugin-pinot476-r9
Chainguardtrino-plugin-postgresql476-r9
Chainguardtrino-plugin-prometheus476-r9
Chainguardtrino-plugin-ranger476-r9
Chainguardtrino-plugin-raptor-legacy476-r9
Chainguardtrino-plugin-redis476-r9
Chainguardtrino-plugin-redshift476-r9
Chainguardtrino-plugin-resource-group-managers476-r9
Chainguardtrino-plugin-session-property-managers476-r9
Chainguardtrino-plugin-singlestore476-r9
Chainguardtrino-plugin-snowflake476-r9
Chainguardtrino-plugin-spooling-filesystem476-r9
Chainguardtrino-plugin-sqlserver476-r9
Chainguardtrino-plugin-teradata-functions476-r9
Chainguardtrino-plugin-thrift476-r9
Chainguardtrino-plugin-tpcds476-r9
Chainguardtrino-plugin-tpch476-r9
Chainguardtrino-plugin-vertica476-r9
Chainguardwso2is7.2.0-r0
Chainguardwso2is-compat7.2.0-r0
Chainguardwso2is-doc7.2.0-r0
Chainguardzookeeper-custom3.9.4-r0
Chainguardzookeeper-custom-oci-entrypoint3.9.4-r0
Debian 13zookeeperno fix
Debian 14zookeeper3.9.4-1
Ubuntu 20.04 LTSzookeeperno fix
Ubuntu 22.04 LTSzookeeperno fix
Ubuntu 24.04 LTSzookeeperno fix
Ubuntu 25.10zookeeperno fix
Ubuntu 26.04 LTSzookeeperno fix
Ubuntu 26.10zookeeperno fix
Ubuntu Pro 14.04 LTSzookeeperno fix
Ubuntu Pro 16.04 LTSzookeeperno fix
Ubuntu Pro 18.04 LTSzookeeperno fix
Wolfiapache-activemq-artemis2.42.0-r9
Wolfiapache-activemq-artemis-compat2.42.0-r9
Wolfiapache-pulsar4.1.0-r1
Wolfiapache-pulsar-compat4.1.0-r1
Wolfikafka-strimzi-compat0.47.0-r8
Wolfikafka_exporter-strimzi-compat0.47.0-r8
Wolfiprometheus-jmx-exporter-strimzi-compat0.47.0-r8
Wolfipyspark-scala-2.133.5.7-r2
Wolfisolr9.9.0-r3
Wolfisolr-oci-compat9.9.0-r3
Wolfispark-3.53.5.7-r2
Wolfispark-3.5-bitnami-compat3.5.7-r2
Wolfispark-3.5-compat3.5.7-r2
Wolfispark-3.5-minimal3.5.7-r2
Wolfispark-3.5-minimal-openjdk-113.5.7-r2
Wolfispark-3.5-minimal-openjdk-173.5.7-r2
Wolfispark-3.5-minimal-openjdk-83.5.7-r2
Wolfispark-3.5-openjdk-113.5.7-r2
Wolfispark-3.5-openjdk-173.5.7-r2
Wolfispark-3.5-openjdk-83.5.7-r2
Wolfispark-3.5-scala-2.123.5.7-r2
Wolfispark-3.5-scala-2.12-bitnami-compat3.5.7-r2
Wolfispark-3.5-scala-2.12-compat3.5.7-r2
Wolfispark-3.5-scala-2.12-iamguarded-compat3.5.7-r2
Wolfispark-3.5-scala-2.12-minimal-openjdk-113.5.7-r2
Wolfispark-3.5-scala-2.12-minimal-openjdk-173.5.7-r2
Wolfispark-3.5-scala-2.12-minimal-openjdk-83.5.7-r2
Wolfispark-3.5-scala-2.12-openjdk-113.5.7-r2
Wolfispark-3.5-scala-2.12-openjdk-173.5.7-r2
Wolfispark-3.5-scala-2.12-openjdk-83.5.7-r2
Wolfispark-3.5-scala-2.133.5.7-r2
Wolfispark-3.5-scala-2.13-compat3.5.7-r2
Wolfispark-3.5-scala-2.13-openjdk-113.5.7-r2
Wolfispark-3.5-scala-2.13-openjdk-173.5.7-r2
Wolfispark-3.5-scala-2.13-openjdk-83.5.7-r2
Wolfispark-4.04.0.1-r1
Wolfispark-4.0-scala-2.134.0.1-r1
Wolfispark-4.0-scala-2.13-compat4.0.1-r1
Wolfistrimzi-kafka-operator0.47.0-r8
Wolfistrimzi-kafka-operator-cluster-operator0.47.0-r8
Wolfistrimzi-kafka-operator-kafka-agent0.47.0-r8
Wolfistrimzi-kafka-operator-kafka-agent-30.47.0-r8
Wolfistrimzi-kafka-operator-kafka-base0.47.0-r8
Wolfistrimzi-kafka-operator-kafka-init0.47.0-r8
Wolfistrimzi-kafka-operator-kafka-thirdparty-libs0.47.0-r8
Wolfistrimzi-kafka-operator-kafka-thirdparty-libs-cc0.47.0-r8
Wolfistrimzi-kafka-operator-mirror-maker-agent0.47.0-r8
Wolfistrimzi-kafka-operator-topic-operator0.47.0-r8
Wolfistrimzi-kafka-operator-tracing-agent0.47.0-r8
Wolfistrimzi-kafka-operator-user-operator0.47.0-r8
Wolfithingsboard4.2-r7
Wolfithingsboard-tb-js-executor4.2-r7
Wolfithingsboard-tb-mqtt-transport4.2-r7
Wolfithingsboard-tb-node4.2-r7
Wolfithingsboard-tb-web-ui4.2-r7
Wolfitrino476-r9
Wolfitrino-config476-r9
Wolfitrino-oci-entrypoint476-r9
Wolfitrino-plugin-accumulo476-r9
Wolfitrino-plugin-ai-functions476-r9
Wolfitrino-plugin-atop476-r9
Wolfitrino-plugin-bigquery476-r9
Wolfitrino-plugin-blackhole476-r9
Wolfitrino-plugin-cassandra476-r9
Wolfitrino-plugin-clickhouse476-r9
Wolfitrino-plugin-delta-lake476-r9
Wolfitrino-plugin-druid476-r9
Wolfitrino-plugin-duckdb476-r9
Wolfitrino-plugin-elasticsearch476-r9
Wolfitrino-plugin-example-http476-r9
Wolfitrino-plugin-exasol476-r9
Wolfitrino-plugin-exchange-filesystem476-r9
Wolfitrino-plugin-exchange-hdfs476-r9
Wolfitrino-plugin-faker476-r9
Wolfitrino-plugin-functions-python476-r9
Wolfitrino-plugin-geospatial476-r9
Wolfitrino-plugin-google-sheets476-r9
Wolfitrino-plugin-hive476-r9
Wolfitrino-plugin-http-event-listener476-r9
Wolfitrino-plugin-http-server-event-listener476-r9
Wolfitrino-plugin-hudi476-r9
Wolfitrino-plugin-iceberg476-r9
Wolfitrino-plugin-ignite476-r9
Wolfitrino-plugin-jmx476-r9
Wolfitrino-plugin-kafka476-r9
Wolfitrino-plugin-kafka-event-listener476-r9
Wolfitrino-plugin-kinesis476-r9
Wolfitrino-plugin-kudu476-r9
Wolfitrino-plugin-lakehouse476-r9
Wolfitrino-plugin-ldap-group-provider476-r9
Wolfitrino-plugin-local-file476-r9
Wolfitrino-plugin-loki476-r9
Wolfitrino-plugin-mariadb476-r9
Wolfitrino-plugin-memory476-r9
Wolfitrino-plugin-ml476-r9
Wolfitrino-plugin-mongodb476-r9
Wolfitrino-plugin-mysql476-r9
Wolfitrino-plugin-mysql-event-listener476-r9
Wolfitrino-plugin-opa476-r9
Wolfitrino-plugin-openlineage476-r9
Wolfitrino-plugin-opensearch476-r9
Wolfitrino-plugin-oracle476-r9
Wolfitrino-plugin-password-authenticators476-r9
Wolfitrino-plugin-phoenix5476-r9
Wolfitrino-plugin-pinot476-r9
Wolfitrino-plugin-postgresql476-r9
Wolfitrino-plugin-prometheus476-r9
Wolfitrino-plugin-ranger476-r9
Wolfitrino-plugin-raptor-legacy476-r9
Wolfitrino-plugin-redis476-r9
Wolfitrino-plugin-redshift476-r9
Wolfitrino-plugin-resource-group-managers476-r9
Wolfitrino-plugin-session-property-managers476-r9
Wolfitrino-plugin-singlestore476-r9
Wolfitrino-plugin-snowflake476-r9
Wolfitrino-plugin-spooling-filesystem476-r9
Wolfitrino-plugin-sqlserver476-r9
Wolfitrino-plugin-teradata-functions476-r9
Wolfitrino-plugin-thrift476-r9
Wolfitrino-plugin-tpcds476-r9
Wolfitrino-plugin-tpch476-r9
Wolfitrino-plugin-vertica476-r9