{"id":"CVE-2018-8012","aliases":["DEBIAN-CVE-2018-8012","DSA-4214-1","EUVD-2022-3562","GHSA-ccqf-c5hq-77mp","UBUNTU-CVE-2018-8012","USN-4789-1"],"status":"published","title":"Missing Authorization in Apache ZooKeeper","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08415,"percentile":0.95026,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2018-05-21T19:00:00Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","fixed_in":["3.4.10","3.5.4-beta"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"zookeeper","fixed_in":["3.4.10-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"zookeeper","fixed_in":["3.4.10-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"zookeeper","fixed_in":["3.4.10-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"zookeeper","fixed_in":["3.4.9-3+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"zookeeper","fixed_in":["3.4.9-3+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zookeeper","fixed_in":["3.4.8-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.9"},{"fixed":"3.4.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-alpha"},{"last_affected":"3.5.3-beta"},{"fixed":"3.5.4-beta"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.9-3+deb8u1"}]}],"versions":["3.4.5+dfsg-2","3.4.5+dfsg-2+deb8u1","3.4.5+dfsg-2+deb8u2","3.4.6-1","3.4.6-2","3.4.6-3","3.4.6-4","3.4.6-5","3.4.6-6","3.4.6-7","3.4.6-8","3.4.7-1","3.4.8-1","3.4.8-2","3.4.9-1","3.4.9-2","3.4.9-3"]},{"source":"osv","ecosystem":"Debian:9","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.9-3+deb9u1"}]}],"versions":["3.4.9-3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.zookeeper:zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-alpha"},{"fixed":"3.5.4-beta"}]}],"versions":["3.5.0-alpha","3.5.1-alpha","3.5.2-alpha","3.5.3-beta"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.5+dfsg-1","3.4.5+dfsg-1ubuntu0.1~esm1","3.4.5+dfsg-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu0.1~esm1"}]}],"versions":["3.4.6-8","3.4.7-1","3.4.8-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.4.5+dfsg-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"zookeeper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-1ubuntu0.1~esm1"}]}],"versions":["3.4.6-8","3.4.7-1","3.4.8-1"],"bundled":3}],"products":[{"vendor":"apache","product":"zookeeper"},{"vendor":"apache software foundation","product":"apache zookeeper"},{"vendor":"debian","product":"debian_linux"},{"vendor":"oracle","product":"goldengate_stream_analytics"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4214","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securitytracker.com/id/1040948","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.securityfocus.com/bid/104253","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393%40%3Cdev.zookeeper.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8f0d920805af93033c488af89104e2d682662bacfb8406db865d5e14%40%3Cdev.jackrabbit.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc5bc4ddb0deabf8cfb69378cecee56fcdc76929bea9e6373cb863870%40%3Cdev.jackrabbit.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r73daf1fc5d85677d9a854707e1908d14e174b7bbb0c603709c0ab33f%40%3Coak-commits.jackrabbit.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3a4048e9515d4afea416df907a612ed384a16c57cf99e97ee4a12f2%40%3Cdev.jackrabbit.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8012","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393@%3Cdev.zookeeper.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r73daf1fc5d85677d9a854707e1908d14e174b7bbb0c603709c0ab33f@%3Coak-commits.jackrabbit.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8f0d920805af93033c488af89104e2d682662bacfb8406db865d5e14@%3Cdev.jackrabbit.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc5bc4ddb0deabf8cfb69378cecee56fcdc76929bea9e6373cb863870@%3Cdev.jackrabbit.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/re3a4048e9515d4afea416df907a612ed384a16c57cf99e97ee4a12f2@%3Cdev.jackrabbit.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ccqf-c5hq-77mp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8012","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-8012","tags":["report"]},{"url":"https://issues.apache.org/jira/browse/ZOOKEEPER-1045","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/05/21/6","tags":["report"]},{"url":"https://cwiki.apache.org/confluence/display/ZOOKEEPER/Server-Server+mutual+authentication","tags":["report"]},{"url":"https://issues.apache.org/jira/secure/attachment/12840904/ZOOKEEPER-1045-br-3-4.patch","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4789-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8012","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5637","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-8012","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2018-05-21T19:00:00Z","modified":"2024-09-17T00:01:04.102Z","updated_at":"2026-11-02T14:35:04.540365Z"}],"euvd":[{"id":"EUVD-2022-3562","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2018-05-21T19:00:00Z","modified":"2024-09-17T00:01:04Z","updated_at":"2026-11-03T00:29:02.877229Z"}],"ghsa":[{"id":"GHSA-ccqf-c5hq-77mp","title":"Missing Authorization in Apache ZooKeeper","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2022-05-13T01:05:57Z","modified":"2023-01-27T05:02:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2018-8012","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2018-05-21T19:29:00.25Z","modified":"2026-06-17T02:04:05.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-8012","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2018-05-21T19:29:00.25Z","modified":"2026-10-24T10:30:58.352195323Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-8012","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2018-05-21T19:29:00.25Z","modified":"2026-10-23T18:03:09.374817853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-ccqf-c5hq-77mp","title":"Missing Authorization in Apache ZooKeeper","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2022-05-13T01:05:57Z","modified":"2023-11-08T04:00:23.872615Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"UBUNTU-CVE-2018-8012","description":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","status":"published","published":"2018-05-21T19:29:00Z","modified":"2026-04-22T12:04:28.561384Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DSA-4214-1","title":"zookeeper - security update","status":"published","published":"2018-06-01T00:00:00Z","modified":"2026-03-09T01:21:40.517837Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"USN-4789-1","title":"zookeeper vulnerabilities","description":"It was discovered that Apache ZooKeeper incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a denial of service or\nother unspecified impact. (CVE-2016-5017)\n\nIt was discovered that Apache ZooKeeper incorrectly implemented \"wchp/wchc\"\ncommands. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2017-5637)\n\nIt was discovered that Apache Zookeeper incorrectly handled clusters. An\nattacker could possibly use this issue to obtain sensitive information.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2018-8012)\n","status":"published","published":"2021-03-15T21:08:52Z","modified":"2026-06-29T13:48:21.045475745Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}