| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.zookeeper:zookeeper | ≥ 3.5.0-alpha, < 3.5.4-beta< 3.4.10 | 3.5.4-beta3.4.10 |
| zookeeper | = 3.5.0= 3.5.3≥ 3.5.0, ≤ 3.5.3< 3.4.10 | 3.4.10 |
| goldengate stream analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free