Bug#1087275: zookeeper: CVE-2024-51504

[Salvatore Bonaccorso]

Source: zookeeper
Version: 3.9.2-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for zookeeper.

CVE-2024-51504[0]:
| When using IPAuthenticationProvider in ZooKeeper Admin Server there
| is a possibility of Authentication Bypass by Spoofing -- this only
| impacts IP based authentication implemented in ZooKeeper Admin
| Server. Default configuration of client's IP address detection
| in IPAuthenticationProvider, which uses HTTP request headers, is
| weak and allows an attacker to bypass authentication via spoofing
| client's IP address in request headers. Default configuration honors
| X-Forwarded-For HTTP header to read client's IP address.
| X-Forwarded-For request header is mainly used by proxy servers to
| identify the client and can be easily spoofed by an attacker
| pretending that the request comes from a different IP address. Admin
| Server commands, such as snapshot and restore arbitrarily can be
| executed on successful exploitation which could potentially lead to
| information leakage or service availability issues. Users are
| recommended to upgrade to version 3.9.3, which fixes this issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-51504
    https://www.cve.org/CVERecord?id=CVE-2024-51504
[1] https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh
[2] https://issues.apache.org/jira/browse/ZOOKEEPER-4851

Regards,
Salvatore