GHSA-crhr-qqj8-rpxc: Maven/org.apache.zookeeper:zookeeper vulnerability
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.zookeeper:zookeeperto a version that resolves this vulnerability.Fixed in 3.8.6 - Upgrade
Upgrade
maven/org.apache.zookeeper:zookeeperto a version that resolves this vulnerability.Fixed in 3.9.5 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.8.6 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.9.5
Event History
Frequently Asked Questions
Which deployments are most likely to be affected?
Production clients are potentially affected because the configuration values are logged at INFO level. The issue applies to Apache ZooKeeper versions 3.8.5 and 3.9.4 on all platforms.
What must happen for sensitive configuration data to be exposed?
The affected client must handle configuration values through ZKConfig, after which those values can be written to the client's logfile at INFO level. An attacker can expose sensitive information stored in client configuration through this improper handling.
Is a configuration change needed for the exposure to occur?
No special logging configuration is identified in the advisory: the values are exposed at INFO level. This means systems that retain standard INFO-level client logs may be affected.
What is the recommended remediation?
Upgrade Apache ZooKeeper to version 3.8.6 or 3.9.5, which fix the issue.