REDHAT-BUG-2445451: High severity Apache Zookeeper vulnerability
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.9.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2445451?
The severity of REDHAT-BUG-2445451 is considered to be high due to the exposure of sensitive configuration information.
How do I fix REDHAT-BUG-2445451?
To mitigate REDHAT-BUG-2445451, it is recommended to upgrade Apache ZooKeeper to versions 3.8.6 or 3.9.5 where the issue is resolved.
Who is affected by REDHAT-BUG-2445451?
Users of Apache ZooKeeper versions 3.8.5 and 3.9.4 on all platforms are affected by REDHAT-BUG-2445451.
What type of vulnerability is REDHAT-BUG-2445451?
REDHAT-BUG-2445451 is a vulnerability that involves improper handling of configuration values leading to sensitive information exposure.
Can REDHAT-BUG-2445451 lead to data breaches?
Yes, REDHAT-BUG-2445451 can potentially lead to data breaches due to the exposure of sensitive information in logs.