Most recent entries from all

bdu:2023-06799

BIT-zookeeper-2023-44981 — Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication

Affected: Bitnami: zookeeper

Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.

Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

See the documentation for more details on correct cluster administration.

certfr-2024-avi-0145 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0145

Withdrawn: CLEANSTART-2026-JU62349 — Security fixes for CVE-2018-10237, CVE-2020-8908, CVE-2021-22569, CVE-2021-22570, CVE-2022-3171, CVE-2022-3509, CVE-202…

Withdrawn by the publisher.

Affected: CleanStart: apache-hive

Multiple security vulnerabilities affect the apache-hive package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-233203

fkie_cve-2023-44981

Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.

Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

See the documentation for more details on correct cluster administration.

GHSA-7286-pgfv-vxvh — Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper

Affected: Maven: org.apache.zookeeper:zookeeper

Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.

Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.

See the documentation for more details on correct cluster administration.

gsd-2023-44981

RHSA-2023:7678 — Red Hat Security Advisory: Red Hat AMQ Streams 2.6.0 release and security update

apache-ivy: XML External Entity vulnerability guava: insecure temporary directory creation JSON-java: parser confusion leads to OOM spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry jose4j: Insecure iteration count setting bouncycastle: potential blind LDAP injection attack using a self-signed certificate jetty: Improper validation of HTTP/1 content-length tomcat: Open Redirect vulnerability in FORM authentication gradle: Possible local text file exfiltration by XML External entity injection gradle: Incorrect permission assignment for symlinked files used in copy or archiving operations zookeeper: Authorization Bypass in Apache ZooKeeper

UBUNTU-CVE-2023-44981

Affected: Ubuntu:Pro:18.04:LTS: zookeeper, Ubuntu:20.04:LTS: zookeeper, Ubuntu:22.04:LTS: zookeeper

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue. See the documentation for more details on correct cluster administration.

WID-SEC-W-2023-3070 — Red Hat JBoss A-MQ: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss A-MQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.