You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@zookeeper.apache.org by "Andor Molnar (Jira)" <ji...@apache.org> on 2026/09/15 18:21:00 UTC
[jira] [Updated] (ZOOKEEPER-5058) Remove special characters from ensemble name before logging in EnsembleAuthenticationProvider
[ https://issues.apache.org/jira/browse/ZOOKEEPER-5058?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Andor Molnar updated ZOOKEEPER-5058:
------------------------------------
Description:
{{EnsembleAuthenticationProvider }}is intended to prevent a client from accidentally connecting to the wrong ZooKeeper ensemble. When a client sends a standard ZooKeeper {{auth}} request with scheme {{{}ensemble{}}}, the request is parsed by the normal network request path and dispatched to the provider.
There is no sanitization step before the user-controlled value is emitted to the logger. Clients could corrupt the logfile in the same that we've seen in ZOOKEEPER-3979.
[CVE-2026-84501|https://www.cve.org/CVERecord?id=CVE-2026-84501]
was:
{{EnsembleAuthenticationProvider }}is intended to prevent a client from accidentally connecting to the wrong ZooKeeper ensemble. When a client sends a standard ZooKeeper {{auth}} request with scheme {{{}ensemble{}}}, the request is parsed by the normal network request path and dispatched to the provider.
There is no sanitization step before the user-controlled value is emitted to the logger. Clients could corrupt the logfile in the same that we've seen in ZOOKEEPER-3979.
> Remove special characters from ensemble name before logging in EnsembleAuthenticationProvider
> ---------------------------------------------------------------------------------------------
>
> Key: ZOOKEEPER-5058
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5058
> Project: ZooKeeper
> Issue Type: Improvement
> Components: security, server
> Affects Versions: 3.9.5, 3.8.6
> Reporter: Andor Molnar
> Assignee: Andor Molnar
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.10.0, 3.8.7, 3.9.6
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> {{EnsembleAuthenticationProvider }}is intended to prevent a client from accidentally connecting to the wrong ZooKeeper ensemble. When a client sends a standard ZooKeeper {{auth}} request with scheme {{{}ensemble{}}}, the request is parsed by the normal network request path and dispatched to the provider.
> There is no sanitization step before the user-controlled value is emitted to the logger. Clients could corrupt the logfile in the same that we've seen in ZOOKEEPER-3979.
> [CVE-2026-84501|https://www.cve.org/CVERecord?id=CVE-2026-84501]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)