You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@aurora.apache.org by GitBox <gi...@apache.org> on 2019/09/17 00:24:55 UTC
[GitHub] [aurora] larrycameron80 opened a new issue #81: Access Control
Bypass
larrycameron80 opened a new issue #81: Access Control Bypass
URL: https://github.com/apache/aurora/issues/81
Access Control Bypass
Vulnerable module: org.apache.zookeeper:zookeeper
Introduced through: org.apache.zookeeper:zookeeper@3.4.8, org.apache.curator:curator-client@2.12.0 and others
Detailed paths
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.zookeeper:zookeeper@3.4.8
Remediation: Upgrade to org.apache.zookeeper:zookeeper@3.4.14.
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-framework@2.12.0 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-recipes@2.12.0 › org.apache.curator:curator-framework@2.12.0 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8
Overview
org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services.
Affected versions of this package are vulnerable to Access Control Bypass. ZooKeeper’s getACL() method doesn’t check any permission when retrieving the ACLs of the requested node and returns all information contained in the ACL Id field as plain text string. If Digest Authentication is in use, the unsalted hash value will be disclosed by the getACL() method for unauthenticated or unprivileged users.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services