VulnerableCode Package Details - pkg:deb/debian/zookeeper@3.9.3-1%2Bdeb13u1

Search for packages

Vulnerability	Summary	Fixed by
VCID-1t8x-dmby-ubep Aliases: CVE-2026-24308 GHSA-crhr-qqj8-rpxc	Apache ZooKeeper has improper handling of configuration values Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.	3.9.5-1 Affected by 0 other vulnerabilities.
VCID-6789-5wwx-qqch Aliases: CVE-2026-24281 GHSA-7xrh-hqfc-g7qr	Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.	3.9.5-1 Affected by 0 other vulnerabilities.
VCID-hbdm-1ts5-f7ad Aliases: CVE-2025-58457 GHSA-2hmj-97jw-28jh	Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the `snapshot` and `restore` commands. The intended requirement is authentication and authorization on the root path (`/`) with ALL permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client. * Affected: `org.apache.zookeeper:zookeeper` 3.9.0 through 3.9.3. * Fixed: 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”). * Mitigations: * Disable both commands (`admin.snapshot.enabled`, `admin.restore.enabled`). * Disable AdminServer (`admin.enableServer`). * Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive. * Upgrade to 3.9.4.	3.9.5-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1t8x-dmby-ubep
Aliases:
CVE-2026-24308
GHSA-crhr-qqj8-rpxc

Apache ZooKeeper has improper handling of configuration values Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

3.9.5-1
Affected by 0 other vulnerabilities.

VCID-6789-5wwx-qqch
Aliases:
CVE-2026-24281
GHSA-7xrh-hqfc-g7qr

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.

3.9.5-1
Affected by 0 other vulnerabilities.

VCID-hbdm-1ts5-f7ad
Aliases:
CVE-2025-58457
GHSA-2hmj-97jw-28jh

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the `snapshot` and `restore` commands. The intended requirement is authentication and authorization on the root path (`/`) with **ALL** permission for these operations; however, affected versions permit invocation without that level of authorization. The primary risk is disclosure of cluster state via snapshots to a lesser-privileged client. * **Affected:** `org.apache.zookeeper:zookeeper` 3.9.0 through 3.9.3. * **Fixed:** 3.9.4 (ZOOKEEPER-4964 “check permissions individually during admin server auth”). * **Mitigations:** * Disable both commands (`admin.snapshot.enabled`, `admin.restore.enabled`). * Disable AdminServer (`admin.enableServer`). * Ensure the root ACL is not open; note that ZooKeeper ACLs are not recursive. * Upgrade to 3.9.4.

3.9.5-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T13:18:15.062215+00:00	Debian Importer	Affected by	VCID-hbdm-1ts5-f7ad	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-16T10:51:51.126089+00:00	Debian Importer	Affected by	VCID-1t8x-dmby-ubep	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-16T10:03:45.288929+00:00	Debian Importer	Affected by	VCID-6789-5wwx-qqch	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-13T09:09:53.645417+00:00	Debian Importer	Affected by	VCID-hbdm-1ts5-f7ad	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-13T07:21:28.521075+00:00	Debian Importer	Affected by	VCID-1t8x-dmby-ubep	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-13T06:45:02.474796+00:00	Debian Importer	Affected by	VCID-6789-5wwx-qqch	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-08T20:05:32.689209+00:00	Debian Importer	Affected by	VCID-hbdm-1ts5-f7ad	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-08T18:53:25.322532+00:00	Debian Importer	Affected by	VCID-1t8x-dmby-ubep	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-08T18:29:16.819680+00:00	Debian Importer	Affected by	VCID-6789-5wwx-qqch	https://security-tracker.debian.org/tracker/data/json	38.1.0