CVE-2026-84501
mediumPriorität · verfolgen · 0EPSS 0.007 · 54. PerzentilDEUSEPSS · bewertet 2026-10-27
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (14)
Betroffene Produkte und Versionsbereiche.
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:21.12.0-21.12.17
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:21.12.0-21.12.18
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:21.12.0.0-21.12.21.9
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:22.12.0-22.12.15
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:22.12.0.0-22.12.21.4
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:23.12.0-23.12.16
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:23.12.0-23.12.20
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:24.12.0-24.12.16
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:25.12.0-25.12.8
- Construction and Engineeringalle Versionencert_bundDEcpe:/a:oracle:construction_and_engineering:25.12.0-25.12.9
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-4089Oracle Construction and Engineering: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- BIT-zookeeper-2026-84501Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider2026-09-19vendor · osvUS
An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (2) nvd
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2026/09/15/7Mailing List
- https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33yMailing ListVendor Advisory
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan