Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta does not enforce any authentication/authorization when a server attempts to join a quorum. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader. External References: http://openwall.com/lists/oss-security/2018/05/21/6 https://cwiki.apache.org/confluence/display/ZOOKEEPER/Server-Server+mutual+authentication https://issues.apache.org/jira/browse/ZOOKEEPER-1045
Created zookeeper tracking bugs for this issue: Affects: fedora-all [bug 1581543]
Zookeeper is not a supported feature of VertX according to: https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html/red_hat_openshift_application_runtimes_release_notes/rn-rutime-components#maven-artifacts-vertx-productized
Zookeeper is also included in vertx as a dependency of the vertx-kafka component. Setting it back to new while we investigate it it's affected or not. [INFO] +- io.vertx:vertx-kafka-client:jar:3.5.1.redhat-003:compile [INFO] | +- org.apache.kafka:kafka-clients:jar:1.0.0:compile [INFO] | | +- org.lz4:lz4-java:jar:1.4:compile [INFO] | | \- org.xerial.snappy:snappy-java:jar:1.1.4:compile [INFO] | +- org.apache.kafka:kafka_2.12:jar:1.0.0:compile [INFO] | | +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:compile [INFO] | | +- com.yammer.metrics:metrics-core:jar:2.2.0:compile [INFO] | | +- com.101tec:zkclient:jar:0.10:compile [INFO] | | \- org.apache.zookeeper:zookeeper:jar:3.4.10:compile
vertx-kafka-client is a component which allows vertx to talk to a kafka instance. It does not actually use zookeeper itself to form a quorom. Setting as NOTAFFECTED. ref: https://vertx.io/docs/vertx-kafka-client/java/
Statement: Zookeeper is not designed to run as a publicly available service and it always needs to be deployed and operated in a secured environment. As a result it is assumed that no zookeeper ports are available publically, so with this assumption JBoss Fuse is not affected by this issue.