Non notée
CVE-2026-24281 Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails,…
Description
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat AMQ Broker 7.12.7 | Versions non publiées | |
| Red Hat AMQ Broker 7.13.5 | Versions non publiées | |
| Red Hat AMQ Broker 7.14.0 | Versions non publiées | |
| Red Hat OpenShift AI 2.25 1776756834 | premières → < 1776756834 | 1776756834 |
| Red Hat build of Debezium 2 | Versions non publiées | |
| Red Hat build of Debezium 3 | Versions non publiées | |
| Red Hat Fuse 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées | |
| Red Hat Offline Knowledge Portal | Versions non publiées |
Afficher les 10 autres branches Masquer les 10 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| streams for Apache Kafka 2 | Versions non publiées | |
| streams for Apache Kafka 3 | Versions non publiées | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions non publiées | |
| Red Hat Data Grid 8 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions non publiées | |
| Apache ZooKeeper 3.9 | 3.9.0 → 3.9.4 | Pas de correctif indiqué |
| Apache ZooKeeper 3.8 | 3.8.0 → 3.8.5 | Pas de correctif indiqué |
| Streams for Apache Kafka 2.9.4 | Versions non publiées |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat AMQ Broker 7.12.7
Les 7 CVE de Red Hat AMQ Broker 7.12.7 →
CVE-2026-5588
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
6.3
Moyenne
CVE-2026-0636
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the…
5.5
Moyenne
CVE-2025-14813
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
9.3
Critique
CVE-2026-33871
Netty is an asynchronous, event-driven network application framework
8.7
Élevée