CVE-2018-8012: High severity Apache Zookeeper vulnerability
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/zookeeperto a version that resolves this vulnerability.Fixed in 3.4.13-2Fixed in 3.4.13-2+deb10u1Fixed in 3.4.13-6Fixed in 3.8.0-11
Event History
Frequently Asked Questions
What is CVE-2018-8012?
CVE-2018-8012 is a vulnerability in Apache ZooKeeper that allows an arbitrary end point to join the cluster and propagate counterfeit changes to the leader.
How does CVE-2018-8012 affect Apache ZooKeeper?
CVE-2018-8012 allows a server to join a quorum in Apache ZooKeeper without authentication or authorization, leading to the potential propagation of counterfeit changes to the leader.
What is the severity of CVE-2018-8012?
CVE-2018-8012 has a severity rating of high, with a score of 7.5.
How can I fix CVE-2018-8012 in Apache ZooKeeper?
To fix CVE-2018-8012, it is recommended to upgrade Apache ZooKeeper to version 3.4.13-2 or later, or version 3.5.3 or later.
Where can I find more information about CVE-2018-8012?
More information about CVE-2018-8012 can be found on the SecurityFocus and SecurityTracker websites, as well as the Apache ZooKeeper mailing list.