Not rated
CVE-2018-8012 No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10,…
Description
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache ZooKeeper | Versions not published |
References
- DSA-4214 www.debian.org
- 1040948 www.securitytracker.com
- 104253 www.securityfocus.com
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar lists.apache.org
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html lists.apache.org
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html lists.apache.org
- www.oracle.com www.oracle.com
- lists.apache.org lists.apache.org
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 opened a new pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 lists.apache.org
- [jackrabbit-dev] 20210716 [GitHub] [jackrabbit-oak] nit0906 commented on pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 lists.apache.org
- [jackrabbit-oak-commits] 20210720 [jackrabbit-oak] branch trunk updated: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 (#326) lists.apache.org
- [jackrabbit-dev] 20210720 [GitHub] [jackrabbit-oak] nit0906 merged pull request #326: OAK-9496 | Update zookeeper version to handle CVE-2018-8012 lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache ZooKeeper
The 19 CVEs of Apache ZooKeeper →
CVE-2026-100302
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
7.1
High
CVE-2026-115448
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
8.7
High
CVE-2026-100300
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
8.7
High
CVE-2026-100252
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
8.6
High