Source: zookeeper Version: 3.9.2-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for zookeeper. CVE-2024-51504[0]: | When using IPAuthenticationProvider in ZooKeeper Admin Server there | is a possibility of Authentication Bypass by Spoofing -- this only | impacts IP based authentication implemented in ZooKeeper Admin | Server. Default configuration of client's IP address detection | in IPAuthenticationProvider, which uses HTTP request headers, is | weak and allows an attacker to bypass authentication via spoofing | client's IP address in request headers. Default configuration honors | X-Forwarded-For HTTP header to read client's IP address. | X-Forwarded-For request header is mainly used by proxy servers to | identify the client and can be easily spoofed by an attacker | pretending that the request comes from a different IP address. Admin | Server commands, such as snapshot and restore arbitrarily can be | executed on successful exploitation which could potentially lead to | information leakage or service availability issues. Users are | recommended to upgrade to version 3.9.3, which fixes this issue. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-51504 https://www.cve.org/CVERecord?id=CVE-2024-51504 [1] https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh [2] https://issues.apache.org/jira/browse/ZOOKEEPER-4851 Regards, Salvatore
