[OAK-10449] oak-solr-osgi embeds vulnerable Zookeeper

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.58.0
• Component/s: indexing
• Assignee: Fabrizio Fortino
• Reporter: Fabrizio Fortino
• Created: 19/Sep/23 15:03
• Updated: 13/Nov/23 13:11
• Resolved: 21/Sep/23 06:57

Description

This artifact embeds Apache ZooKeeper 3.4.10 which contains the following vulnerabilitie(s):

• BDSA-2013-0048 in version 3.4.10 (CVSS 7.5 High): Apache ZooKeeper contains an information disclosure vulnerability due to a missing permission check within the `getACL` command. An attacker could exploit this to obtain hashes for authentication, if Digest Authentication is in use.
• CVE-2020-10663 in version 3.4.10 (CVSS 7.5 High): The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Issue Links

• is cloned by: OAK-10548 oak-solr-osgi embeds vulnerable Zookeeper 3.4.14
• links to: GitHub Pull Request #1127