NetSight
IP …
high7.5

CVE-2018-8012

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta.

Impact

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.

Affected products

VendorProductAffected versions
ApacheZookeeper
before 3.4.10
from 3.5.0 through 3.5.3
Versions 3.5.0, 3.5.3
DebianDebian Linux
Versions 8.0, 9.0
OracleGoldengate Stream Analytics
before 19.1.0.0.1

Weakness classification

CWE-862

References