[
https://issues.apache.org/jira/browse/ZOOKEEPER-5058?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andor Molnar resolved ZOOKEEPER-5058.
-------------------------------------
Fix Version/s: 3.10.0
3.8.7
3.9.6
Resolution: Fixed
> Remove special characters from ensemble name before logging in
> EnsembleAuthenticationProvider
> ---------------------------------------------------------------------------------------------
>
> Key: ZOOKEEPER-5058
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5058
> Project: ZooKeeper
> Issue Type: Improvement
> Components: security, server
> Affects Versions: 3.9.5, 3.8.6
> Reporter: Andor Molnar
> Assignee: Andor Molnar
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.10.0, 3.8.7, 3.9.6
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> {{EnsembleAuthenticationProvider }}is intended to prevent a client from
> accidentally connecting to the wrong ZooKeeper ensemble. When a client sends
> a standard ZooKeeper {{auth}} request with scheme {{{}ensemble{}}}, the
> request is parsed by the normal network request path and dispatched to the
> provider.
> There is no sanitization step before the user-controlled value is emitted to
> the logger. Clients could corrupt the logfile in the same that we've seen in
> ZOOKEEPER-3979.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
