CVE-2024-23944: Apache ZooKeeper: Information disclosure in persistent watcher handling
First published: Thu Mar 14 2024(Updated: )
Apache ZooKeeper could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in persistent watchers handling. By attaching a persistent watcher to a parent, an attacker could exploit this vulnerability to obtain information of the full path of znodes, and use this information to launch further attacks against the affected system.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.zookeeper:zookeeper | >=3.6.0<=3.7.2 | |
| maven/org.apache.zookeeper:zookeeper | >=3.9.0<=3.9.1 | 3.9.2 |
| maven/org.apache.zookeeper:zookeeper | >=3.8.0<=3.8.3 | 3.8.4 |
| IBM Planning Analytics Local - IBM Planning Analytics Workspace | <=2.1 | |
| IBM Planning Analytics Local - IBM Planning Analytics Workspace | <=2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread/96s5nqssj03rznz9hv58txdb2k1lr79k
- http://www.openwall.com/lists/oss-security/2024/03/14/2
- https://nvd.nist.gov/vuln/detail/CVE-2024-23944
- https://github.com/apache/zookeeper/commit/29c7b9462681f47c2ac12e609341cf9f52abac5c
- https://github.com/apache/zookeeper/commit/65b91d2d9a56157285c2a86b106e67c26520b01d
- https://github.com/apache/zookeeper/commit/daf7cfd04005cff1a4f7cab5ab13d41db88d0cd8
- https://github.com/advisories/GHSA-r978-9m6m-6gm6 (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/285579
- https://www.ibm.com/support/pages/node/7151122 (Advisory)
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-23944
- agent/title
- agent/first-publish-date
- agent/weakness
- agent/type
- agent/event
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r978-9m6m-6gm6
- agent/software-canonical-lookup
- collector/nvd-cve
- collector/github-advisory
- agent/severity
- agent/description
- agent/last-modified-date
- agent/references
- agent/tags
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup-request
- package-manager/maven
- vendor/ibm
- canonical/ibm planning analytics local - ibm planning analytics workspace
- version/ibm planning analytics local - ibm planning analytics workspace/2.1
- version/ibm planning analytics local - ibm planning analytics workspace/2.0