[ZOOKEEPER-4484] Critical Security Vulnerabilities in Apache Zookeper image

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Invalid
• Affects Version/s: 3.7.0
• Assignee: Unassigned
• Reporter: Debanjan Bhowmick
• Created: 03/Mar/22 04:07
• Updated: 07/Mar/22 08:34
• Resolved: 03/Mar/22 07:14

Description

We have found this below list of CRITICAL Security vulnerabilties present in the official zookeper image -

Vulnerability ID	Component	Infected versions	Fixed versions
CVE-2021-33574	debian:bullseye:libc6:2.31-13+deb11u2	N/A	N/A
XRAY-179837	io.netty:netty-codec:4.1.59.Final	< 4.1.66.Final	4.1.66.Final
CVE-2022-23307	log4j:log4j:1.2.17	All Versions	N/A
CVE-2019-17571	log4j:log4j:1.2.17	≤ 1.2.17	N/A
CVE-2022-23305	log4j:log4j:1.2.17	1.1.0 ≤ Version ≤ 1.2.17	N/A
CVE-2022-23219	debian:bullseye:libc6:2.31-13+deb11u2	N/A	N/A
CVE-2022-23218	debian:bullseye:libc6:2.31-13+deb11u2	N/A	N/A

Can you please help us with the fix or update us on the release of security patches and also their respective timelines.

 

Issue Links

• is related to: ZOOKEEPER-3995 Vulnerabilities in components packaged in zookeeper docker
• is related to: ZOOKEEPER-4426 Fix Docker Hub Zookeeper-Versions to CVE-2021-44228