CVE-2018-8012: Apache ZooKeeper Quorum Peer mutual authentication

Related Vulnerabilities: CVE-2018-8012   CVE-2017-5637  

Debian Bug report logs - #899332
CVE-2018-8012: Apache ZooKeeper Quorum Peer mutual authentication

version graph

Reported by: Markus Koschany <apo@debian.org>

Date: Tue, 22 May 2018 21:33:01 UTC

Severity: grave

Tags: fixed-upstream, security, upstream

Found in version zookeeper/3.3.5+dfsg1-2

Fixed in versions zookeeper/3.4.10-1, zookeeper/3.4.9-3+deb9u1, zookeeper/3.4.9-3+deb8u1

Done: Markus Koschany <apo@debian.org>

Bug is archived. No further changes may be made.

Forwarded to https://issues.apache.org/jira/browse/ZOOKEEPER-1045

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>:
Bug#899332; Package zookeeper. (Tue, 22 May 2018 21:33:04 GMT) (full text, mbox, link).


Acknowledgement sent to Markus Koschany <apo@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>. (Tue, 22 May 2018 21:33:04 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: submit@bugs.debian.org
Subject: CVE-2018-8012: Apache ZooKeeper Quorum Peer mutual authentication
Date: Tue, 22 May 2018 23:29:58 +0200
[Message part 1 (text/plain, inline)]
Package: zookeeper
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security
Fixed: 3.4.10-1

Hi,

The following vulnerability was published for zookeeper.

CVE-2018-8012[0]:
| No authentication/authorization is enforced when a server attempts to
| join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha
| through 3.5.3-beta. As a result an arbitrary end point could join the
| cluster and begin propagating counterfeit changes to the leader.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-8012
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8012

Please adjust the affected versions in the BTS as needed.

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Marked as fixed in versions zookeeper/3.4.10-1. Request was from Markus Koschany <apo@debian.org> to control@bugs.debian.org. (Tue, 22 May 2018 21:51:03 GMT) (full text, mbox, link).


Marked as found in versions zookeeper/3.3.5+dfsg1-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 23 May 2018 04:27:02 GMT) (full text, mbox, link).


Added tag(s) upstream and fixed-upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 23 May 2018 04:27:03 GMT) (full text, mbox, link).


Set Bug forwarded-to-address to 'https://issues.apache.org/jira/browse/ZOOKEEPER-1045'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 23 May 2018 04:27:04 GMT) (full text, mbox, link).


Message sent on to Markus Koschany <apo@debian.org>:
Bug#899332. (Wed, 23 May 2018 21:33:03 GMT) (full text, mbox, link).


Message #16 received at 899332-submitter@bugs.debian.org (full text, mbox, reply):

From: apo@debian.org
To: 899332-submitter@bugs.debian.org
Subject: Bug #899332 in zookeeper marked as pending
Date: Wed, 23 May 2018 21:28:36 +0000
Control: tag -1 pending

Hello,

Bug #899332 in zookeeper reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below, and you can check the diff of the fix at:

https://salsa.debian.org/java-team/zookeeper/commit/525cd00b67d07df6b1f49e25a49af35b8e0c0ee4

------------------------------------------------------------------------
Import Debian changes 3.4.9-3+deb9u1

zookeeper (3.4.9-3+deb9u1) stretch-security; urgency=high

  * Team upload.
  * Fix CVE-2018-8012:
    No authentication/authorization is enforced when a server attempts to join
    a quorum in Apache ZooKeeper. As a result an arbitrary end point could join
    the cluster and begin propagating counterfeit changes to the leader.
    (Closes: #899332)

------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/899332



Added tag(s) pending. Request was from apo@debian.org to 899332-submitter@bugs.debian.org. (Wed, 23 May 2018 21:33:03 GMT) (full text, mbox, link).


Message sent on to Markus Koschany <apo@debian.org>:
Bug#899332. (Thu, 24 May 2018 20:21:05 GMT) (full text, mbox, link).


Message #21 received at 899332-submitter@bugs.debian.org (full text, mbox, reply):

From: apo@debian.org
To: 899332-submitter@bugs.debian.org
Subject: Bug #899332 in zookeeper marked as pending
Date: Thu, 24 May 2018 20:19:43 +0000
Control: tag -1 pending

Hello,

Bug #899332 in zookeeper reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below, and you can check the diff of the fix at:

https://salsa.debian.org/java-team/zookeeper/commit/be4d752cddfe4371a185100ddc52b5775d46df1a

------------------------------------------------------------------------
Import Debian changes 3.4.9-3+deb8u1

zookeeper (3.4.9-3+deb8u1) jessie-security; urgency=high

  * Team upload.
  * Fix CVE-2018-8012:
    No authentication/authorization is enforced when a server attempts to join
    a quorum in Apache ZooKeeper. As a result an arbitrary end point could join
    the cluster and begin propagating counterfeit changes to the leader.
    (Closes: #899332)

zookeeper (3.4.9-3) unstable; urgency=medium

  * Team upload.
  * Apply patch for CVE-2017-5637 (Closes: #863811)
    "wchp" and "wchc" are now disabled by default.

zookeeper (3.4.9-2) unstable; urgency=medium

  * Team upload.
  * Apply patch to set JAVA in the environment (Closes: #839184)
    - Thank you to Felix Dreissig.
  * Add patch for spelling corrections in upstream source.

zookeeper (3.4.9-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Updated debian/pom.xml
  * Updated the upstream signing keys

zookeeper (3.4.8-2) unstable; urgency=medium

  * Team upload.
  * Add systemd unit file.  (Closes: #830222)
    - Thanks to Felix Dreissig for the patch series.
  * Add dh-python to Build-Depends.  (Closes: #830216)
    - Thanks to Felix Dreissig for the patch.
  * Standards-Version updated to 3.9.8 (no changes)

zookeeper (3.4.8-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Updated debian/pom.xml
  * Standards-Version updated to 3.9.7 (no changes)
  * Use secure Vcs-* URLs

zookeeper (3.4.7-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
    - Updated debian/pom.xml
  * Updated the upstream signing keys

zookeeper (3.4.6-8) unstable; urgency=medium

  * Team upload.
  * Fixed the netty dependency for libzookeeper-java (Closes: #797229)

zookeeper (3.4.6-7) unstable; urgency=medium

  * Team upload.
  * Build-dep on liblogx4cxx-dev.  See transition bug #792013.
    (Closes: #794418)

zookeeper (3.4.6-6) unstable; urgency=medium

  * Team upload.
  * Depend on libnetty-3.9-java instead of libnetty-java

zookeeper (3.4.6-5) unstable; urgency=medium

  * Team upload.
  * Fixed the packaging type of the Maven artifact (pom -> jar)
  * Improved the build reproducibility:
    - Set the locale to 'en' when generating the javadoc

zookeeper (3.4.6-4) unstable; urgency=medium

  * Team upload.
  * Upload to unstable
  * Improved the build reproducibility:
    - Removed the Built-At, Built-By and Built-On entries in the manifests
    - Use the changelog date as the build date in Info.java

zookeeper (3.4.6-3) experimental; urgency=medium

  * Team upload.
  * Fixed the Maven rule for netty to work with maven-repo-helper << 1.8.10

zookeeper (3.4.6-2) experimental; urgency=medium

  * Team upload.
  * Fixed the groupId of netty in the installed pom

zookeeper (3.4.6-1) experimental; urgency=medium

  * Team upload.

  [ James Page ]
  * d/control: Bump epoch on default-jdk BD to exclude archictectures which
    don't have Java 6 or better (Closes: #742405).

  [ Tim Retout ]
  * New upstream version.  (Closes: #756982)
  * debian/patches: Refresh patches.

  [ Emmanuel Bourg ]
  * Install the Maven artifacts (Closes: #775893)
  * Standards-Version updated to 3.9.6 (no changes)
  * Fixed some lintian warnings related to debian/copyright
  * libzookeeper-java suggests libzookeeper-java-doc but doesn't recommend it
  * Install the API documentation under /usr/share/doc/libzookeeper-java
    instead of usr/share/doc/libzookeeper-java-doc
  * debian/orig-tar.sh:
    - Removed src/contrib/loggraph from the upstream tarball since it isn't used
      and is missing the source of a minimized JavaScript file (yui-min.js)
    - Use XZ compression for the upstream tarball
    - Delete the non filtered upstream tarball after unpacking it
  * Added the .patch extension to the patches
  * Added the missing patch descriptions

------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/899332



Reply sent to Markus Koschany <apo@debian.org>:
You have taken responsibility. (Sun, 03 Jun 2018 11:06:03 GMT) (full text, mbox, link).


Notification sent to Markus Koschany <apo@debian.org>:
Bug acknowledged by developer. (Sun, 03 Jun 2018 11:06:03 GMT) (full text, mbox, link).


Message #26 received at 899332-close@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: 899332-close@bugs.debian.org
Subject: Bug#899332: fixed in zookeeper 3.4.9-3+deb9u1
Date: Sun, 03 Jun 2018 11:03:01 +0000
Source: zookeeper
Source-Version: 3.4.9-3+deb9u1

We believe that the bug you reported is fixed in the latest version of
zookeeper, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 899332@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Markus Koschany <apo@debian.org> (supplier of updated zookeeper package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 23 May 2018 22:34:43 +0200
Source: zookeeper
Binary: libzookeeper-java zookeeper zookeeperd libzookeeper-java-doc libzookeeper-mt2 libzookeeper-st2 libzookeeper2 libzookeeper-mt-dev libzookeeper-st-dev zookeeper-bin python-zookeeper
Architecture: source all amd64
Version: 3.4.9-3+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Description:
 libzookeeper-java - Core Java libraries for zookeeper
 libzookeeper-java-doc - API Documentation for zookeeper
 libzookeeper-mt-dev - Development files for multi threaded zookeeper C bindings
 libzookeeper-mt2 - Multi threaded C bindings for zookeeper
 libzookeeper-st-dev - Development files for single threaded zookeeper C bindings
 libzookeeper-st2 - Single threaded C bindings for zookeeper
 libzookeeper2 - C bindings for zookeeper - transitional package
 python-zookeeper - Python bindings for zookeeper
 zookeeper  - High-performance coordination service for distributed application
 zookeeper-bin - Command line utilities for zookeeper
 zookeeperd - Init control scripts for zookeeper
Closes: 899332
Changes:
 zookeeper (3.4.9-3+deb9u1) stretch-security; urgency=high
 .
   * Team upload.
   * Fix CVE-2018-8012:
     No authentication/authorization is enforced when a server attempts to join
     a quorum in Apache ZooKeeper. As a result an arbitrary end point could join
     the cluster and begin propagating counterfeit changes to the leader.
     (Closes: #899332)
Checksums-Sha1:
 a6a48b15200bce99d31dbe225f9059b324c3cd77 3172 zookeeper_3.4.9-3+deb9u1.dsc
 a0a6168dcd380c5586c8dcfa144668f7a1a21c6d 1931392 zookeeper_3.4.9.orig.tar.xz
 2fe8590457e4515736317981af6fd1516b6abcaa 85716 zookeeper_3.4.9-3+deb9u1.debian.tar.xz
 c5091e0426ba7598532af8408f8879e71e523fc4 370720 libzookeeper-java-doc_3.4.9-3+deb9u1_all.deb
 9bf2bfacb54d0a632beabbf4a1cbeffada11c601 1359262 libzookeeper-java_3.4.9-3+deb9u1_all.deb
 a5bef36affab800e5ac48c7c202bb184337ecae6 90994 libzookeeper-mt-dev_3.4.9-3+deb9u1_amd64.deb
 4e0e903f7b9f756e9812fee183a1540055de49d8 112724 libzookeeper-mt2-dbgsym_3.4.9-3+deb9u1_amd64.deb
 c967d314f53b91efebade14c13dab294c52e2ef9 75078 libzookeeper-mt2_3.4.9-3+deb9u1_amd64.deb
 fc30b5d6d9cefca01d60bb4317681f7a09e753c7 88256 libzookeeper-st-dev_3.4.9-3+deb9u1_amd64.deb
 14069b6a75858005e7baa6e2682c0f4280a4196b 105602 libzookeeper-st2-dbgsym_3.4.9-3+deb9u1_amd64.deb
 fd6a0334b6e4b500f5588aac5d6f14e47a5dd102 72852 libzookeeper-st2_3.4.9-3+deb9u1_amd64.deb
 1cc66c88bd2488681d95f53ad65805f946678f00 40828 libzookeeper2_3.4.9-3+deb9u1_amd64.deb
 5bbd6a12879b4b20a02d1c3d347a99a55dc24bea 32354 python-zookeeper-dbgsym_3.4.9-3+deb9u1_amd64.deb
 9b10fb36caa12c344e54db0c18c656249e91c730 58224 python-zookeeper_3.4.9-3+deb9u1_amd64.deb
 f3a7ed0ae7ddc28cae7c4adc72631c824f3a1c46 413398 zookeeper-bin-dbgsym_3.4.9-3+deb9u1_amd64.deb
 9934cbe5f3aede4a86a6ed0cb254e3033274789c 94542 zookeeper-bin_3.4.9-3+deb9u1_amd64.deb
 49d81cdba9dd32e0bdf37a66594dcae440827ef2 141838 zookeeper_3.4.9-3+deb9u1_all.deb
 ac130e91cc22ace1e7a0e8bdbd873cf85ec7f120 17396 zookeeper_3.4.9-3+deb9u1_amd64.buildinfo
 cb490a37f99b8d821da77c719a58b5ae9602fd79 43936 zookeeperd_3.4.9-3+deb9u1_all.deb
Checksums-Sha256:
 4d84f7ba36423fe4d24fa23571324f340c01ba315f0c15f0f386b5959e93324e 3172 zookeeper_3.4.9-3+deb9u1.dsc
 1471e69d0b391c87208ec5a6ef5c6dbb1e31820b274b34ebd9a808940f36410b 1931392 zookeeper_3.4.9.orig.tar.xz
 0639c57a977d65d4b83a8a0a4745eb9be8f4b868cd43cb36be8f1db4d2b0a96d 85716 zookeeper_3.4.9-3+deb9u1.debian.tar.xz
 71b5255a322f4c34147231c1a19044c22cd4c7ac5b395c0e3735153e0a75f993 370720 libzookeeper-java-doc_3.4.9-3+deb9u1_all.deb
 ab7bb2ea817e14bef634632a3a5e3a54d32d1865b49d227907b3364a66f2539b 1359262 libzookeeper-java_3.4.9-3+deb9u1_all.deb
 4f8c0c6db1047b15fb893eb12eb566cf91be8f46fd79aae6ddc4d8b5afaade78 90994 libzookeeper-mt-dev_3.4.9-3+deb9u1_amd64.deb
 f1c4808320f7a9bc62a189eca5a5571345b372361315f67abbb2c72bd30eebe7 112724 libzookeeper-mt2-dbgsym_3.4.9-3+deb9u1_amd64.deb
 e8f167a3f7f3f072858d14664e49ddd7c0ae96fb8d7419641bf3a9464c6029cb 75078 libzookeeper-mt2_3.4.9-3+deb9u1_amd64.deb
 3d0fb18710a9db14ee3f019fee9eae12cce588e29f0548f5d334f428776770c6 88256 libzookeeper-st-dev_3.4.9-3+deb9u1_amd64.deb
 6c3316e7bef378ae434288f515126d76baf85a87607d147cf6c3a08fd8481e7f 105602 libzookeeper-st2-dbgsym_3.4.9-3+deb9u1_amd64.deb
 ea3d79a73654579b0f224187dc61d2cd27d190dc9d76099acfcc2c4e3737a673 72852 libzookeeper-st2_3.4.9-3+deb9u1_amd64.deb
 821268b5eb870853f84f13218cccdbe41a5b9e2f0a84c3de18d6e14bfedaca94 40828 libzookeeper2_3.4.9-3+deb9u1_amd64.deb
 692041e296743fc0902042630bab5db199270d78c30023d1454257ec4fdc65d6 32354 python-zookeeper-dbgsym_3.4.9-3+deb9u1_amd64.deb
 51c1cccdfa48dcc70a609ef9667f413abd21221dd11919b698f465e3d45df207 58224 python-zookeeper_3.4.9-3+deb9u1_amd64.deb
 26abf824dc45e6701c79a8318997214ebfcd57254d851b5342bfd33d06b90554 413398 zookeeper-bin-dbgsym_3.4.9-3+deb9u1_amd64.deb
 5385f85a04fe2abf40816ee537207b5349e104e766edba7b97fb503e00fbeb83 94542 zookeeper-bin_3.4.9-3+deb9u1_amd64.deb
 fcf686ab1085bc5b6eb885ece13ac244bb6a40c7eeaa55ecce551596c4bb3a16 141838 zookeeper_3.4.9-3+deb9u1_all.deb
 f971559017f8fd51775a81d28f0997548ad47842bf2bccf825332f9c145c2344 17396 zookeeper_3.4.9-3+deb9u1_amd64.buildinfo
 97d4dd4ebc45a0f887c9c6a2772af0d535b2756d308ebdee3c5248d12d0ba0f7 43936 zookeeperd_3.4.9-3+deb9u1_all.deb
Files:
 f1efd070588f838c63a9725be50dd5ce 3172 java optional zookeeper_3.4.9-3+deb9u1.dsc
 d33aa506accaeade4260f1ba26ad3b8e 1931392 java optional zookeeper_3.4.9.orig.tar.xz
 418dd9a3c464aacf1463b76fe077f530 85716 java optional zookeeper_3.4.9-3+deb9u1.debian.tar.xz
 aa4b09fc6588ce6ab99d9e927e1a4b77 370720 doc optional libzookeeper-java-doc_3.4.9-3+deb9u1_all.deb
 f6fb17e3d0670a84a429d436453379bc 1359262 java optional libzookeeper-java_3.4.9-3+deb9u1_all.deb
 2443404c93df05e46b68a8cf23026d7f 90994 libdevel optional libzookeeper-mt-dev_3.4.9-3+deb9u1_amd64.deb
 5e6ed526fe30ec5067538b1312c2df6d 112724 debug extra libzookeeper-mt2-dbgsym_3.4.9-3+deb9u1_amd64.deb
 007348e69dc471ae88a009e70284587e 75078 libs optional libzookeeper-mt2_3.4.9-3+deb9u1_amd64.deb
 ec7dec76297bf06e246216dcf6f6c076 88256 libdevel optional libzookeeper-st-dev_3.4.9-3+deb9u1_amd64.deb
 5c11636cd5931663f7b18624c31f1219 105602 debug extra libzookeeper-st2-dbgsym_3.4.9-3+deb9u1_amd64.deb
 960b474c66ab71a91af1bb8e1462d7b0 72852 libs optional libzookeeper-st2_3.4.9-3+deb9u1_amd64.deb
 a4caf371910cda4f3c8811249638b179 40828 oldlibs extra libzookeeper2_3.4.9-3+deb9u1_amd64.deb
 f5e8a0d3e5f4808bd97c578d9830dffb 32354 debug extra python-zookeeper-dbgsym_3.4.9-3+deb9u1_amd64.deb
 d06d50cb9fab477cbdb2f6a329e19c43 58224 python optional python-zookeeper_3.4.9-3+deb9u1_amd64.deb
 5c6e308742d99552459e458fc2e8810f 413398 debug extra zookeeper-bin-dbgsym_3.4.9-3+deb9u1_amd64.deb
 539b242851e6239fec3689fe0e6938d2 94542 misc optional zookeeper-bin_3.4.9-3+deb9u1_amd64.deb
 e5ad46db2651c1e3a57f876e28b426a7 141838 java optional zookeeper_3.4.9-3+deb9u1_all.deb
 d8081485be2cc1ca031d1a123a578f88 17396 java optional zookeeper_3.4.9-3+deb9u1_amd64.buildinfo
 159f085f1b76a744fa08aec80daf04ad 43936 java optional zookeeperd_3.4.9-3+deb9u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlsMXMRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HkGbMQAI39esR5CF5ni8TYE+9rwl1GhBoHk4FIkPPn
e/aMmkYfmHP2X93RqDG322RgQBH/flmllTHIW56g9CbdG3j2pKSvVANN1NLYbKbI
y3s7D85Idw+7Z633Q2TTmfVeNvGLKNVezaKVIodNsmK0cXA8zIXoabv3pYrvzaWT
bf+JUXPRpsQkSYF1AluFoHwJeLoqyho/WoHYngongQ1VZOyzfjmLTbiG3umrNED6
pnzpzF4eb4zLxZQMIrwPeI7MrTbGrcCu4r8X9rQxeumbIy3SjTkfnCd2altrfcr4
Ja4WBKx+HMTghe4OiqwL5ilNxr+z+i81TF3RY27/GPJaGaKGBxQHYaG7oH8C54Wp
/6gqrcNoLkjOWtu3+zGy/SF0wF0WZ/2wZKEGYfsQ+I1YSCqEXuZ7MB7cma4wwEip
oS6yN6UeqtPEW8I+n8MJ3DSOUljNcr4oAdLBMgG7tnlx2wCXG5oaIBTSbdSV5dl4
A9O5D2rHZ/yGLAJvzkK+W/G2eb14g2p2FEVXx+rLPlL0HYWta7O+D4qG+U5e8D5S
qCvCsIVbEc6V2ESw0sIIv0jyq4DKeBP/3Ugnzm5otNPhdR/eyrCXEaFjTTQFQlOh
mMUc6ggB+hltAbxxQI3FN6g3SovxD+GUd829zibS5iVe43Kx8zo0VDlUIaFWAC4C
Kz2zVLb/
=FbAp
-----END PGP SIGNATURE-----




Reply sent to Markus Koschany <apo@debian.org>:
You have taken responsibility. (Sun, 03 Jun 2018 11:36:05 GMT) (full text, mbox, link).


Notification sent to Markus Koschany <apo@debian.org>:
Bug acknowledged by developer. (Sun, 03 Jun 2018 11:36:05 GMT) (full text, mbox, link).


Message #31 received at 899332-close@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: 899332-close@bugs.debian.org
Subject: Bug#899332: fixed in zookeeper 3.4.9-3+deb8u1
Date: Sun, 03 Jun 2018 11:32:43 +0000
Source: zookeeper
Source-Version: 3.4.9-3+deb8u1

We believe that the bug you reported is fixed in the latest version of
zookeeper, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 899332@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Markus Koschany <apo@debian.org> (supplier of updated zookeeper package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 23 May 2018 22:34:43 +0200
Source: zookeeper
Binary: libzookeeper-java zookeeper zookeeperd libzookeeper-java-doc libzookeeper-mt2 libzookeeper-st2 libzookeeper2 libzookeeper-mt-dev libzookeeper-st-dev zookeeper-bin python-zookeeper
Architecture: source all amd64
Version: 3.4.9-3+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Description:
 libzookeeper-java - Core Java libraries for zookeeper
 libzookeeper-java-doc - API Documentation for zookeeper
 libzookeeper-mt-dev - Development files for multi threaded zookeeper C bindings
 libzookeeper-mt2 - Multi threaded C bindings for zookeeper
 libzookeeper-st-dev - Development files for single threaded zookeeper C bindings
 libzookeeper-st2 - Single threaded C bindings for zookeeper
 libzookeeper2 - C bindings for zookeeper - transitional package
 python-zookeeper - Python bindings for zookeeper
 zookeeper  - High-performance coordination service for distributed application
 zookeeper-bin - Command line utilities for zookeeper
 zookeeperd - Init control scripts for zookeeper
Closes: 899332
Changes:
 zookeeper (3.4.9-3+deb8u1) jessie-security; urgency=high
 .
   * Team upload.
   * Fix CVE-2018-8012:
     No authentication/authorization is enforced when a server attempts to join
     a quorum in Apache ZooKeeper. As a result an arbitrary end point could join
     the cluster and begin propagating counterfeit changes to the leader.
     (Closes: #899332)
Checksums-Sha1:
 998a04487105c16bbe274e99492f5698caa6dcf0 3155 zookeeper_3.4.9-3+deb8u1.dsc
 d69f715874b0b10dfbc78628fce46efed124e6b0 85904 zookeeper_3.4.9-3+deb8u1.debian.tar.xz
 26049d166ecff43d7f10a7bef0f2f849ecc96cba 1357160 libzookeeper-java_3.4.9-3+deb8u1_all.deb
 d4ad48201a4c49ea154c8853704bd5e1817c497f 141926 zookeeper_3.4.9-3+deb8u1_all.deb
 b45f8ea49c91439febd422e23a59e52b0453d2ca 44086 zookeeperd_3.4.9-3+deb8u1_all.deb
 e33dc030a7d615e4afff3bbcebb0076fa9eecf90 408444 libzookeeper-java-doc_3.4.9-3+deb8u1_all.deb
 1605e7b097c67a8a91f2bb07fcd8ef8a640b5d1d 74838 libzookeeper-mt2_3.4.9-3+deb8u1_amd64.deb
 2550b3a193d676ce20e69e4f37ea04756af7599c 72602 libzookeeper-st2_3.4.9-3+deb8u1_amd64.deb
 35253bf9784d4f49360fa1b9adf295bafb5a75f9 40920 libzookeeper2_3.4.9-3+deb8u1_amd64.deb
 03ca7858c1df8a72d31b286d843f57e9b05d1d23 90550 libzookeeper-mt-dev_3.4.9-3+deb8u1_amd64.deb
 1471c24202d401496b2b4a8102dad80fe643d227 88028 libzookeeper-st-dev_3.4.9-3+deb8u1_amd64.deb
 8ad92ac4cea89eae9990a17d427cd3074ea97b8c 91760 zookeeper-bin_3.4.9-3+deb8u1_amd64.deb
 3fbbd1781e91f483814d33ce3c4d74795ed4bfd6 58006 python-zookeeper_3.4.9-3+deb8u1_amd64.deb
Checksums-Sha256:
 8ec6d971241071d124e6d8f7b51de89a8ea3c0f68a1d6a9e3e7bc805fef6cd21 3155 zookeeper_3.4.9-3+deb8u1.dsc
 79ff86a628a465119740dad2ca0e1002785f2dd91ffc33b294b11a9dc39cf2be 85904 zookeeper_3.4.9-3+deb8u1.debian.tar.xz
 b2ad50d47b6933416aeaa67632268b2219ab67f5eaf0f6bb6cf0e96b33a30044 1357160 libzookeeper-java_3.4.9-3+deb8u1_all.deb
 dbeaf2c75018dcaee1c4fd3f6a32432923f63960125f123a5ffd7895b2e93d57 141926 zookeeper_3.4.9-3+deb8u1_all.deb
 38adcc83453c256495f519bf20e5f132bd5d62b6717ebfed02d350dec42b85be 44086 zookeeperd_3.4.9-3+deb8u1_all.deb
 d9d1ba25fb1c7484cbb00217457eef4e22c084ed5446f416201f79fb12a49a93 408444 libzookeeper-java-doc_3.4.9-3+deb8u1_all.deb
 38462062d49522a8e28b7e5983395f1f45d33ce1f10fc1eba639414fb233df0f 74838 libzookeeper-mt2_3.4.9-3+deb8u1_amd64.deb
 f1a4216114a14deb41615257084f231660a4d549090648bc36ad8174c16beb2a 72602 libzookeeper-st2_3.4.9-3+deb8u1_amd64.deb
 d0965ca6bde5aaf03cdf583d1531e194866cd53dd4c0211ac21a94cab7cf620c 40920 libzookeeper2_3.4.9-3+deb8u1_amd64.deb
 8cab63a20f17cb754da6e0fd5d755038016559750a17ba185e3c7571180b48a9 90550 libzookeeper-mt-dev_3.4.9-3+deb8u1_amd64.deb
 892fe5ae3fb1bfe7657f8c5349ec808a4405750cb29d043d384ddbf92fcf0525 88028 libzookeeper-st-dev_3.4.9-3+deb8u1_amd64.deb
 ca4161783944388f7dfb8f49474035c3ab851ac65c4e44c0b7b448bffbd3115f 91760 zookeeper-bin_3.4.9-3+deb8u1_amd64.deb
 143f0ab0127c202a19510268148b88f76fd2447a102e689a163f0d2c30edc39d 58006 python-zookeeper_3.4.9-3+deb8u1_amd64.deb
Files:
 2158e4fda7db8d01e371db0be8377588 3155 java optional zookeeper_3.4.9-3+deb8u1.dsc
 ea992dd38e5a1605ea1f681d77c9209e 85904 java optional zookeeper_3.4.9-3+deb8u1.debian.tar.xz
 31601185873292c095e51eed348ff552 1357160 java optional libzookeeper-java_3.4.9-3+deb8u1_all.deb
 6ac297b10a1d9673c275b6e65fd4e0c5 141926 java optional zookeeper_3.4.9-3+deb8u1_all.deb
 e07182c59c98a59025a57de78be26f54 44086 java optional zookeeperd_3.4.9-3+deb8u1_all.deb
 d8b23e6ac84d95fcdf6e8f1dd58567b9 408444 doc optional libzookeeper-java-doc_3.4.9-3+deb8u1_all.deb
 cb74d4076d8058a6e817fa7aec10e271 74838 libs optional libzookeeper-mt2_3.4.9-3+deb8u1_amd64.deb
 80ec7160cc68944c6bbd96d1087d4cc1 72602 libs optional libzookeeper-st2_3.4.9-3+deb8u1_amd64.deb
 f7ba3dbb225e4ef04ce1d716e9230116 40920 oldlibs extra libzookeeper2_3.4.9-3+deb8u1_amd64.deb
 0a8018b54a824260322a74907aa2092b 90550 libdevel optional libzookeeper-mt-dev_3.4.9-3+deb8u1_amd64.deb
 0d927229e2afadaf8a8b6cbc10ef3213 88028 libdevel optional libzookeeper-st-dev_3.4.9-3+deb8u1_amd64.deb
 e74ebe8f70b17927b937a7a5a8b4a71a 91760 misc optional zookeeper-bin_3.4.9-3+deb8u1_amd64.deb
 d6e812a07d483961276c7bee68611ed3 58006 python optional python-zookeeper_3.4.9-3+deb8u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlsPA/1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HktAwQAMhrghjDgu9vsGUb94i1OncSbiWrsQxxaYf/
n6aW9gIdNkIlGt3RuTZeteteHY8r4s9FsPhHQk58d4ORwnLdpU8qykMjEOYJXxQO
0ESWeRjV+5HFsHHtkP/t2e0bWWe0C+3JvZyq+4c+ByoLj7HcDjAFLlRI9jMHEdmB
DmTOSXrRM8K/8JvhQoB3HjWeNyA+Vz1J6+VsGw57wGjkCMmPKp026rz61MX0FeXH
Yckoae7xodc1BFs7V2wwttbZSkTP5GYsH0l9RkQWJIwea4OO2IFaO/Ice26GhPB0
Sywj/6mre3AnYNlHDGxqBYbwfGeMZMVNr9gd7U+0fq8GYzPrijTMGEJP+qhKn+kN
zYa6vEAXRnJE/xHb9HCBjk/LZVpON9GCLXukz60PquhaiA8HX4AKPj1vr0vCPUwb
y0YVK0BY6aa6C5hMFj+iEUX2mze8Sr2IDZCBMQOYBEdpsswAMBhx40CxaFXjRISo
Xq/zGFYvWriAi6oAuOyo0lmni1aw1dt41uIS4Zy9fnpA6zYWidcqUXBAmpymH2oV
ih4zGkvPFH0zPUQgkMlLBqZ+URyF2Di8GuYBp6vyDLjkcb075ggadKMhexqt8bXX
y6r1dsmPn2qh45bC22TJv5m9RcLK/a8fw027JTZor587yxYIiB0+DyHS59gy9PUt
0V0uPLHT
=m2l/
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 15 Jul 2018 07:28:05 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 16:36:24 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.