Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN269
_____________________________________________________________________

DATE                : 09/03/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache ZooKeeper versions prior
                                   to 3.8.6, 3.9.5.

=====================================================================
https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr
https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2
_____________________________________________________________________

CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure
in client configuration handling

Severity: important 

Affected versions:

- Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.9.0 through 3.9.4
- Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.8.0 through 3.8.5

Description:

Improper handling of configuration values in ZKConfig in Apache
ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to
expose sensitive information stored in client configuration in the
client's logfile. Configuration values are exposed at INFO level
logging rendering potential production systems affected by the issue.
Users are recommended to upgrade to version 3.8.6 or 3.9.5 which
fixes this issue.

Credit:

Youlong Chen <ch...@ict.ac.cn> (reporter)

References:

https://zookeeper.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-24308

_____________________________________________________________________

CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables
hostname verification bypass in ZooKeeper ZKTrustManager

Severity: important 

Affected versions:

- Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.9.0 through 3.9.4
- Apache ZooKeeper (org.apache.zookeeper:zookeeper) 3.8.0 through 3.8.5

Description:

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to
reverse DNS (PTR) when IP SAN validation fails, allowing attackers who
control or spoof PTR records to impersonate ZooKeeper servers or
clients with a valid certificate for the PTR name. It's important to
note that attacker must present a certificate which is trusted by
ZKTrustManager which makes the attack vector harder to exploit. Users
are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes
this issue by introducing a new configuration option to disable
reverse DNS lookup in client and quorum protocols.

This issue is being tracked as ZOOKEEPER-4986 

Credit:

Nikita Markevich <ma...@gmail.com> (reporter)

References:

https://zookeeper.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-24281
https://issues.apache.org/jira/browse/ZOOKEEPER-4986


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================