Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NApache Zookeeper
APPApache3.8.0 – 3.8.6 (bez)3.9.0 – 3.9.5 (bez)
Powiązane podatności
Apache ZooKeeper: Authentication Bypass przez spoofing adresu IP
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authen...
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validatio...
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before...
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache...