The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3624 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3624-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     October 20, 2023                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : zookeeper     Version        : 3.4.13-2+deb10u1     CVE ID         : CVE-2023-44981     Debian Bug     : 1054224

    It was discovered that there was a potential authorisation bypass     vulnerability in Apache Zookeeper, a co-ordination service for     reliable distributed applications.

    Specifically, if SASL Quorum Peer authentication was enabled via     quorum.auth.enableSasl, authorisation was performed by verifying that     the instance part in the SASL authentication ID was listed in the     zoo.cfg server list. However, this value is optional, and, if missing     (such as in 'eve@EXAMPLE.COM'), the authorisation check will be     skipped. As a result, an arbitrary endpoint could join the cluster     and begin propagating counterfeit changes to the leader, essentially     giving it complete read-write access to the data tree.

    For Debian 10 buster, this problem has been fixed in version     3.4.13-2+deb10u1.

    We recommend that you upgrade your zookeeper packages.

    For the detailed security status of zookeeper please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/zookeeper

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3624 : libzookeeper-java - security update

critical Nessus Plugin ID 183523

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.1 Mar 21, 2024, 2:00 PM IAVM reference Plugin Feed: 202403211400
Version 1.0 Oct 21, 2023, 1:17 AM New Plugin Feed: 202310210117