漏洞“Apache Zookeeper 授权问题漏洞(CVE-2019-0201)”详情

最新推荐文章于 2024-08-04 11:09:02 发布

my_qq_990814268

最新推荐文章于 2024-08-04 11:09:02 发布

阅读量2.7k

点赞数

分类专栏：运维文章标签： zookeeper

本文链接：https://blog.youkuaiyun.com/liangkaiping0525/article/details/110189558

版权

运维专栏收录该内容

36 篇文章

订阅专栏

本文介绍Apache Zookeeper CVE-2019-0201授权问题漏洞，该漏洞存在于1.0.0至3.4.13及3.5.0-alpha至3.5.4-beta版本。文章提供了详细的漏洞描述、CVSS评分及解决方案。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

扫描漏洞详情如下：

1.漏洞详情

漏洞名称	Apache Zookeeper 授权问题漏洞(CVE-2019-0201)
发现日期	2019-05-23
CVSS评分	5.9
漏洞描述	Apache Zookeeper是美国阿帕奇（Apache）软件基金会的一个软件项目，它能够为大型分布式计算提供开源的分布式配置服务、同步服务和命名注册等功能。 Apache ZooKeeper 1.0.0版本至3.4.13版本和3.5.0-alpha版本至3.5.4-beta版本中存在授权问题漏洞。该漏洞源于网络系统或产品中缺少身份验证措施或身份验证强度不足。
解决方案	厂商补丁: 目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://zookeeper.apache.org/security.html#CVE-2019-0201

解决方式：

只授权集群内部访问

zkCli.sh 进入zk后执行如下命令：

setAcl / ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /zookeeper ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /cluster ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /controller_epoch ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /controller ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /brokers ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /feature ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /admin ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /isr_change_notification ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /consumers ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /log_dir_event_notification ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /latest_producer_id_block ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa
setAcl /config ip:192.168.0.13:cdrwa,ip:192.168.0.14:cdrwa,ip:192.168.0.15:cdrwa,ip:127.0.0.1:cdrwa