CVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling
First published: Thu Mar 14 2024(Updated: )
Apache ZooKeeper could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in persistent watchers handling. By attaching a persistent watcher to a parent, an attacker could exploit this vulnerability to obtain information of the full path of znodes, and use this information to launch further attacks against the affected system.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.zookeeper:zookeeper | >=3.6.0<=3.7.2 | |
| maven/org.apache.zookeeper:zookeeper | >=3.9.0<=3.9.1 | 3.9.2 |
| maven/org.apache.zookeeper:zookeeper | >=3.8.0<=3.8.3 | 3.8.4 |
| IBM QRadar Security Information and Event Manager | <=7.5 - 7.5.0 UP9 IF03 | |
| IBM Security QRadar Incident Forensics | <=7.5 - 7.5.0 UP9 IF03 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k
- http://www.openwall.com/lists/oss-security/2024/03/14/2
- https://nvd.nist.gov/vuln/detail/CVE-2024-23944
- https://github.com/apache/zookeeper/commit/29c7b9462681f47c2ac12e609341cf9f52abac5c
- https://github.com/apache/zookeeper/commit/65b91d2d9a56157285c2a86b106e67c26520b01d
- https://github.com/apache/zookeeper/commit/daf7cfd04005cff1a4f7cab5ab13d41db88d0cd8
- https://github.com/advisories/GHSA-r978-9m6m-6gm6 (Advisory)
- https://www.ibm.com/support/pages/node/7173420 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-23944?
The severity of CVE-2024-23944 is classified as medium due to its potential impact on sensitive information disclosure.
How do I fix CVE-2024-23944?
To fix CVE-2024-23944, upgrade Apache ZooKeeper to version 3.7.3, 3.8.4 or 3.9.2 or later releases.
Which versions of Apache ZooKeeper are affected by CVE-2024-23944?
Versions 3.6.0 to 3.7.2 and 3.9.0 to 3.9.1 of Apache ZooKeeper are affected by CVE-2024-23944.
Can an unauthenticated attacker exploit CVE-2024-23944?
No, CVE-2024-23944 requires a remote authenticated attacker to exploit the vulnerability.
What potential information can be obtained through CVE-2024-23944?
An attacker exploiting CVE-2024-23944 can obtain the full path of znodes in the ZooKeeper data tree.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-23944
- agent/title
- agent/first-publish-date
- agent/weakness
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r978-9m6m-6gm6
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- agent/event
- collector/github-advisory
- agent/severity
- agent/trending
- agent/source
- agent/references
- agent/softwarecombine
- collector/nvd-api
- agent/last-modified-date
- agent/description
- agent/tags
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup-request
- package-manager/maven
- vendor/ibm
- canonical/ibm qradar security information and event manager
- version/ibm qradar security information and event manager/7.5 - 7.5.0 up9 if03
- canonical/ibm security qradar incident forensics
- version/ibm security qradar incident forensics/7.5 - 7.5.0 up9 if03