Description
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ZooKeeper | Apache ZooKeeper prior to 3.4.10, Apache ZooKeeper 3.5.0-alpha through 3.5.3-beta | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zookeeper | 3.4.10-2 | — |
| Debian 13 | zookeeper | 3.4.10-2 | — |
| Debian 12 | zookeeper | 3.4.10-2 | — |
| Debian 9 | zookeeper | 3.4.9-3+deb9u1 | DSA-4214-1 |
| Debian 8 | zookeeper | 3.4.9-3+deb8u1 | DSA-4214-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | zookeeper | 3.4.8-1ubuntu0.1~esm1 | USN-4789-1 |
| Ubuntu Pro 14.04 LTS | zookeeper | 3.4.5+dfsg-1ubuntu0.1~esm1 | USN-4789-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.zookeeper:zookeeper | < 3.4.10 | 3.4.10 | GHSA-ccqf-c5hq-77mp |
| Maven | org.apache.zookeeper:zookeeper | >= 3.5.0-alpha, < 3.5.4-beta | 3.5.4-beta | GHSA-ccqf-c5hq-77mp |
Advisories 4
- WID-SEC-2026-2751 IBM InfoSphere Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-4789-1 zookeeper vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- DSA-4214-1 zookeeper - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
References
- DSA-4214 vendor-advisory
- 1040948 vdb-entry
- 104253 vdb-entry
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806 mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393%40%3Cdev.zookeeper.apache.org%3E
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 opened a new pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 mailing-list
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 commented on pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 mailing-list
- [jackrabbit-oak-commits] 20210720 [jackrabbit-oak] branch trunk updated: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 (#326) mailing-list
- [jackrabbit-dev] 20210720 [GitHub] [jackrabbit-oak] nit0906 merged pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 mailing-list