CVE-2023-44981
published 2023-10-11CVE-2023-44981: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper…
PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.71%
74.8th percentile
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.
Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.
Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.
See the documentation for more details on correct cluster administration.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | zookeeper | < 3.7.2 | 3.7.2 |
| apache | zookeeper | — | — |
| apache | zookeeper | >= 0 < 3.4.13-6+deb11u1 | 3.4.13-6+deb11u1 |
| apache | zookeeper | >= 0 < 3.8.0-11+deb12u1 | 3.8.0-11+deb12u1 |
| apache | zookeeper | >= 0 < 3.9.1-1 | 3.9.1-1 |
| apache | zookeeper | >= 0 < 3.9.1-1 | 3.9.1-1 |
| apache | zookeeper | >= 0 < 3.4.13-5ubuntu0.1 | 3.4.13-5ubuntu0.1 |
| apache | zookeeper | >= 0 < 3.4.13-6ubuntu4.1 | 3.4.13-6ubuntu4.1 |
| apache | zookeeper | >= 0 < 3.4.5+dfsg-1ubuntu0.1~esm3 | 3.4.5+dfsg-1ubuntu0.1~esm3 |
| apache | zookeeper | >= 0 < 3.4.8-1ubuntu0.1~esm2 | 3.4.8-1ubuntu0.1~esm2 |
| apache | zookeeper | >= 0 < 3.4.13-3ubuntu0.1~esm1 | 3.4.13-3ubuntu0.1~esm1 |
| apache | zookeeper | >= 3.8.0 < 3.8.3 | 3.8.3 |
| apache_software_foundation | apache_zookeeper | < 3.7.0 | 3.7.0 |
| apache_software_foundation | apache_zookeeper | 3.7.0 – 3.7.1 | — |
| apache_software_foundation | apache_zookeeper | 3.8.0 – 3.8.2 | — |
| apache_software_foundation | apache_zookeeper | >= 3.9.0 < 3.9.1 | 3.9.1 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | zookeeper | < zookeeper 3.8.0-11+deb12u1 (bookworm) | zookeeper 3.8.0-11+deb12u1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Authorization bypass is triggered when the instance part of the SASL authentication ID is missing (e.g., only realm present like '[email protected]'). Detect peers joining the ZooKeeper quorum whose SASL ID contains no instance/host component before the '@' separator. ↗
- →Monitor ZooKeeper quorum/election traffic for unexpected peers joining the cluster, especially those presenting SASL credentials without an instance part, which would indicate exploitation of this bypass. ↗
- →This vulnerability is only exploitable when quorum.auth.enableSasl=true is set in zoo.cfg. Audit ZooKeeper configurations for this setting to identify exposed instances. ↗
- →A malicious actor exploiting this flaw would use a SASL authentication ID with a non-existing or absent instance part to bypass the peer authorization controller and join the ZooKeeper ensemble. ↗
- ·The vulnerability is NOT exploitable unless SASL Quorum Peer authentication is explicitly enabled. Default ZooKeeper deployments are not affected. ↗
- ·Red Hat AMQ 7 Broker and AMQ Streams 2 use ZooKeeper but do not enable Peer Authentication, so the vulnerable code path is not reachable in those products. ↗
- ·Red Hat Fuse 7 uses ZooKeeper but does not use any of its server capabilities, making it not vulnerable to this specific flaw. ↗
- ·As a network-level mitigation (not a fix), protecting ZooKeeper ensemble election/quorum communication with a firewall will prevent exploitation. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_oracle9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache ZooKeeper) — CVE-2023-44981
vendor_oracle·2024-04-15·CVSS 8.1
CVE-2023-44981 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache ZooKeeper) — CVE-2023-44981
Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache ZooKeeper) vulnerability
CVE: CVE-2023-44981
CVSS: 8.1
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
Ubuntu
ZooKeeper vulnerabilities
vendor_ubuntu·2024-01-16·CVSS 5.9
CVE-2023-44981 [MEDIUM] ZooKeeper vulnerabilities
Title: ZooKeeper vulnerabilities
Summary: Several security issues were fixed in ZooKeeper.
It was discovered that ZooKeeper incorrectly handled authorization for
the getACL() command. A remote attacker could possibly use this issue to
obtain sensitive information. This issue only affected Ubuntu 14.04
LTS and Ubuntu 16.04 LTS. (CVE-2019-0201)
Damien Diederen discovered that ZooKeeper incorrectly handled
authorization if SASL Quorum Peer authentication is enabled. An
attacker could possibly use this issue to bypass ZooKeeper's
authorization system. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04
and Ubuntu 23.10. (CVE-2023-44981)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache ZooKeeper) — CVE-2023-44981
vendor_oracle·2024-01-15·CVSS 9.1
CVE-2023-44981 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache ZooKeeper) — CVE-2023-44981
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache ZooKeeper) vulnerability
CVE: CVE-2023-44981
CVSS: 9.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Red Hat
zookeeper: Authorization Bypass in Apache ZooKeeper
vendor_redhat·2023-10-11·CVSS 9.1
CVE-2023-44981 [CRITICAL] CWE-639 zookeeper: Authorization Bypass in Apache ZooKeeper
zookeeper: Authorization Bypass in Apache ZooKeeper
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.
Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the iss
Debian
CVE-2023-44981: zookeeper - Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeep...
vendor_debian·2023·CVSS 9.1
CVE-2023-44981 [CRITICAL] CVE-2023-44981: zookeeper - Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeep...
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum c
OSV
zookeeper vulnerabilities
osv·2024-01-16·CVSS 5.9
CVE-2019-0201 [MEDIUM] zookeeper vulnerabilities
zookeeper vulnerabilities
It was discovered that ZooKeeper incorrectly handled authorization for
the getACL() command. A remote attacker could possibly use this issue to
obtain sensitive information. This issue only affected Ubuntu 14.04
LTS and Ubuntu 16.04 LTS. (CVE-2019-0201)
Damien Diederen discovered that ZooKeeper incorrectly handled
authorization if SASL Quorum Peer authentication is enabled. An
attacker could possibly use this issue to bypass ZooKeeper's
authorization system. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04
and Ubuntu 23.10. (CVE-2023-44981)
GHSA
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
ghsa·2023-10-11
CVE-2023-44981 [CRITICAL] CWE-639 Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.
Users are recommended to upgrade to version 3.9.1, 3
OSV
CVE-2023-44981: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
osv·2023-10-11·CVSS 9.1
CVE-2023-44981 [CRITICAL] CVE-2023-44981: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum c
OSV
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
osv·2023-10-11
CVE-2023-44981 [CRITICAL] Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.
Users are recommended to upgrade to version 3.9.1, 3
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, April 2026 Security Update Review
blogs_qualys·2026-04-22
CVE-2025-6965 Oracle Critical Patch Update, April 2026 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 481 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 139, constituting about 28% of the total patches released. Oracle Financial Services Applications and Oracle Fusion Middleware followed, with 75 and 59 security patches.
376 of the 481 security patches provided by the April Critical Patch Update (about 78%)
Qualys
Oracle Patch Update, January 2024 Security Update Review
blogs_qualys·2024-01-17
Oracle Patch Update, January 2024 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle has released its first quarterly edition of Critical Patch Update, which contains patches for 389 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in a wide range of product families, including Oracle code and third-party components included in Oracle products.
In the first quarterly Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of patches, 71, constituting 18% of the total patches released. Oracle Communications and Oracle Communications Applications follow
Qualys
Oracle Patch Update, January 2024 Security Update Review | Qualys
blogs_qualys·2024-01-17
Oracle Patch Update, January 2024 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Oracle has released its first quarterly edition of Critical Patch Update, which contains patches for 389 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in a wide range of product families, including Oracle code and third-party components included in Oracle products.
In the first quarterly Oracle Critical Patch Update, Oracle Financial Services Applications received the highest number of patches, 71, constituting 18% of the total patches released. Oracle Communications and Oracle Communications Applications
http://www.openwall.com/lists/oss-security/2023/10/11/4https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5bhttps://lists.debian.org/debian-lts-announce/2023/10/msg00029.htmlhttps://security.netapp.com/advisory/ntap-20240621-0007/https://www.debian.org/security/2023/dsa-5544http://www.openwall.com/lists/oss-security/2023/10/11/4https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5bhttps://lists.debian.org/debian-lts-announce/2023/10/msg00029.htmlhttps://security.netapp.com/advisory/ntap-20240621-0007/https://www.debian.org/security/2023/dsa-5544
2023-10-11
Published