mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-31 10:46:16 +00:00
Code Issues Releases Activity

security/vuxml: Record kafka vulnerability

Browse Source 
Authorization Bypass Through User-Controlled Key vulnerability in Apache
ZooKeeper.

Note that this only affects SASL Quorum Peer authentication which is
not enabled by default.

 Base Score:	9.1 CRITICAL
 Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

PR:	275611
This commit is contained in:
Fernando Apesteguía 2023-12-10 18:05:14 +01:00
parent eea55ca7b5
commit a991db5e17
1 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
security/vuxml/vuln/2023.xml
View File

@ -1,3 +1,45 @@
<vuln vid="2bc376c0-977e-11ee-b4bc-b42e991fc52e">
<topic>apache -- Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication</topic>
<affects>
<package>
<name>apache</name>
<range><lt>3.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>security@apache.org reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2023/10/11/4">
<p>Authorization Bypass Through User-Controlled Key vulnerability in
Apache ZooKeeper. If SASL Quorum Peer authentication is enabled
in ZooKeeper (quorum.auth.enableSasl=true), the authorization is
done by verifying that the instance part in SASL authentication ID
is listed in zoo.cfg server list. The instance part in SASL auth
ID is optional and if it&apos;s missing, like &apos;eve@EXAMPLE.COM&apos;,
the authorization check will be skipped.As a result an arbitrary
endpoint could join the cluster and begin propagating counterfeit
changes to the leader, essentially giving it complete read-write
access to the data tree.Quorum Peer authentication is not enabled
by default.
Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2,
which fixes the issue.
Alternately ensure the ensemble election/quorum communication is
protected by a firewall as this will mitigate the issue.
See the documentation for more details on correct cluster administration.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2023-44981</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2023-44981</url>
</references>
<dates>
<discovery>2023-10-11</discovery>
<entry>2023-12-10</entry>
</dates>
</vuln>
<vuln vid="bbda3d16-968e-11ee-b780-b42e991fc52e">
<topic>strongswan -- buffer overflow</topic>
<affects>