{"id":"CVE-2018-8012","details":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.","aliases":["GHSA-ccqf-c5hq-77mp"],"modified":"2026-07-08T05:56:24.278557652Z","published":"2018-05-21T19:29:00.250Z","database_specific":{"unresolved_ranges":[{"vendor_product":"oracle:goldengate_stream_analytics","cpes":["cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"19.1.0.0.1"}],"source":"CPE_RANGE"},{"extracted_events":[{"introduced":"3.5.0-alpha"},{"last_affected":"3.5.0-alpha"},{"introduced":"3.5.3-beta"},{"last_affected":"3.5.3-beta"}],"source":"CPE_STRING","vendor_product":"apache:zookeeper","cpes":["cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:*","cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}]}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/c75147028c1c79bdebd4f8fa5db2b77da85de2b05ecc0d54d708b393%40%3Cdev.zookeeper.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r73daf1fc5d85677d9a854707e1908d14e174b7bbb0c603709c0ab33f%40%3Coak-commits.jackrabbit.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r8f0d920805af93033c488af89104e2d682662bacfb8406db865d5e14%40%3Cdev.jackrabbit.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rc5bc4ddb0deabf8cfb69378cecee56fcdc76929bea9e6373cb863870%40%3Cdev.jackrabbit.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/re3a4048e9515d4afea416df907a612ed384a16c57cf99e97ee4a12f2%40%3Cdev.jackrabbit.apache.org%3E"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/104253"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1040948"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4214"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujul2020.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/zookeeper","events":[{"introduced":"0"},{"fixed":"b0aaa7de5b28375cd34ead8c8fbf14e3ebddd30f"},{"introduced":"22dd197a0327eef989feaf2109e5e7371624f743"},{"last_affected":"8ce24f9e675cbefffb8f21a47e06b42864475a60"}],"database_specific":{"cpe":"cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.4.10"},{"introduced":"3.5.0"},{"last_affected":"3.5.3"}],"source":"CPE_RANGE"}}],"versions":["release-3.5.3-rc1","release-3.5.3-rc0","release-3.5.3","release-3.4.10-rc0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8012.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}