REDHAT-BUG-2445449: High severity Apache Zookeeper vulnerability
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.9.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2445449?
The severity of REDHAT-BUG-2445449 is considered critical due to the potential for attackers to impersonate ZooKeeper servers or clients.
How do I fix REDHAT-BUG-2445449?
To fix REDHAT-BUG-2445449, you should upgrade to Apache ZooKeeper version 3.9.6 or later, where the issue has been addressed.
What vulnerability does REDHAT-BUG-2445449 exploit?
REDHAT-BUG-2445449 exploits hostname verification failure in ZKTrustManager by falling back to reverse DNS (PTR) when IP SAN validation fails.
Who is affected by REDHAT-BUG-2445449?
Any user or organization utilizing Apache ZooKeeper versions prior to 3.9.6 is affected by REDHAT-BUG-2445449.
What are the implications of ignoring REDHAT-BUG-2445449?
Ignoring REDHAT-BUG-2445449 can lead to unauthorized access or man-in-the-middle attacks due to trusted impersonation of ZooKeeper services.