Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2018-8012 →

DEBIAN-CVE-2018-8012

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-b...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 zookeeper

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-2"}]}]

Debian:13 zookeeper

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-2"}]}]

Debian:14 zookeeper

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-2"}]}]

Références

advisory security-tracker.debian.org