Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-23944 BIT-zookeeper-2024-23944EUVD-2024-1001GHSA-r978-9m6m-6gm6

Apache ZooKeeper: Information disclosure in persistent watcher handling

Published Mar 15, 2024 · Updated Jul 3, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache ZooKeeper Package: confluent-common-docker Package: confluent-kafka Package: org.apache.zookeeper:zookeeper Package: tez Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: zookeeper Package: zookeeper Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching a persistent watcher (addWatch command) to a parent which the attacker has already access to. ZooKeeper server doesn't do ACL check when the persistent watcher is triggered and as a consequence, the full path of znodes that a watch event gets triggered upon is exposed to the owner of the watcher. It's important to note that only the path is exposed by this vulnerability, not the data of znode, but since znode path can contain sensitive information like user name or login ID, this issue is potentially critical.

Users are recommended to upgrade to version 3.9.2, 3.8.4 which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache ZooKeeper 3.9.0 – ≤ 3.9.1, 3.8.0 – ≤ 3.8.3, 3.6.0 – ≤ 3.7.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 zookeeper 3.9.2-1 —
Debian 13 zookeeper 3.9.2-1 —
Debian 12 zookeeper 3.8.0-11+deb12u2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS zookeeper No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling confluent-common-docker 7.6.9-r0 —
Wolfi rolling confluent-kafka 8.2.0.367-r0 —
Wolfi rolling tez 0.10.4-r6 —
Wolfi rolling trino +58 443-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.zookeeper:zookeeper >= 3.8.0, < 3.8.4 3.8.4 GHSA-r978-9m6m-6gm6
Maven org.apache.zookeeper:zookeeper >= 3.9.0, < 3.9.2 3.9.2 GHSA-r978-9m6m-6gm6
Maven org.apache.zookeeper:zookeeper >= 3.6.0, <= 3.7.2 — GHSA-r978-9m6m-6gm6

Advisories 2

References