Threats tagged 'ghsa-mm24-r27q-hxg5'

Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 contain a vulnerability where an unauthenticated attacker can inject arbitrary fake log lines into the operational log by sending a crafted add_auth("ensemble", ...) request with newline characters. This causes the server to log unsanitized input, allowing forged log entries that appear indistinguishable from legitimate logs. Upgrading to versions 3.8.7 or 3.9.6 resolves the issue.