Threats tagged 'ghsa-f5cq-cgxv-j9m8'

A time-of-check to time-of-use (TOCTOU) race condition in Apache ZooKeeper's setACL request handling allows a client to perform operations with permissions that have been revoked but not yet fully enforced. This can enable unauthorized actions such as committing writes or deletes after losing write access or re-granting full permissions persistently. The vulnerability affects Apache ZooKeeper versions up to and including 3.9.6. Upgrading to versions 3.8.8 or 3.9.7 resolves the issue.