Hi.

The release notes for https://zookeeper.apache.org/doc/r3.6.3/releasenotes.html
list various security issues:
CVE-2020-25649
CVE-2021-21295
CVE-2021-28165
CVE-2021-21409

It's a bit unclear to me  whether 3.4 is affected to, but since 3.5.x versions seem
to be, I'd guess the issues go back longer and may affect 3.4 as well.

I would guess that 3.4.x has no upstream support anymore.


Cheers,
Chirs.

[Disclaimer, not the package maintainer, but quickly checked your
report for tracking within the security team]

To me this looks like CVEs in other products, but which zookeeper uses
as dependency? Is this correct? CVE-2021-21409 is for instance for
netty and fixed in 1:41.48-4 and in DSA 4885-1.

CVE-20202-25649 was in jackson-databind. Similar for the other CVEs
mentioned in the release notes, and they usually refer to "upgrate X.Y
to version [...], dependency check, etc.

I have not (yet) checked the respective imapct and if something needs
to be changed about those specifically in zookeeper.

Regards,
Salvatore

Hey.

Indeed, but I couldn't find that the zookeeper package depends on these
while it does contain:
zookeeper-3.4.13/src$ find . -iname "*nett*"
./java/main/org/apache/zookeeper/server/NettyServerCnxnFactory.java
./java/main/org/apache/zookeeper/server/NettyServerCnxn.java
./java/test/org/apache/zookeeper/server/NettyServerCnxnTest.java
./java/test/org/apache/zookeeper/test/NioNettySuiteTest.java
./java/test/org/apache/zookeeper/test/NioNettySuiteHammerTest.java
./java/test/org/apache/zookeeper/test/NioNettySuiteBase.java


... so I figured these might still be affected?


And apart from that... if they apparently don't support older versions
anymore, we'd like not even notice should these contain any security
issues.


Cheers,
Chris.

The Debian package disables building against Netty via this patch:

https://salsa.debian.org/java-team/zookeeper/-/blob/master/debian/patches/13-disable-netty-connection-factory.patch

This is certainly a valid point.  There is not time to change the
situation for bullseye aside from filing an RM bug to prevent the
package from shipping with the release.  That would impact transitive
dependencies of which I believe activemq is the most significant.

As an aside, I took a quick look at the latest upstream activemq source
release (https://activemq.apache.org/activemq-5016002-release) and it
specifies zookeeper 3.4.14 in its pom.xml (which makes me feel a little
better).

We can work on addressing the situation in bookworm.  (One idea I would
propose is paring down the package to build just libzookeeper-java,
because I imagine that many people use the Debian package to run their
ZooKeeper ensembles, although maybe that's not true.)

Help is always appreciated.

Cheers,
tony

Ah I see.

Would it be possible to provide a more current version via backports...
I mean if it's not possible to get it in via some st
able-update or so?

Isn’t that just telling the minimum version that works with it - not
what they'd consider a safe use from a security PoV?

Well I for example use the daemon, too, but the software from which I
use it would anyway already require some newer version and doesn't work
with 3.4 anymore.
So for me that wouldn't matter much.


Thanks,
Chris.

Yes, this should be possible.  I believe we would need to call the
package zookeeper35 or zookeeper36.

I don't recall there being API issues (although I need to check), but we
encountered problems at my $dayjob trying to use ZK 3.5 libraries in
applications interacting with ZK 3.4 servers.  IIRC, the issue has to do
with TTL nodes and was problematic enough that we ended up forking the
application to have ZK 3.4 and ZK 3.5 variants.

It's good to know that there are users of the package.  (For my $dayjob
use case, ZK deployments are now container-based using the upstream
binary distribution.)

I will set aside some time to look at what it would take to build a
ZK 3.6 package against Debian and we can continue the discussion.

Cheers,
tony

Further for the records (for a future upgrade to newer ZK versions):


There will likely need to be a NEWS.Debian entry about the following:

https://issues.apache.org/jira/browse/ZOOKEEPER-3056

In short:
- apparently they've added a check that prevents ZK from starting, when
no snapshots were found in the dataDir

- the workaround is to ONCE set
  snapshot.trust.empty=true

  (the zookeeper.snapshot.trust.empty=true mentioned in most messages
  of the bug does not work, which is mentioned in some later answers)

- start up the server

- remove the setting again
  quoting:
  "It is recommended to remove the property once you have a working
  server, because that check is important to ensure that the system is
  in good shape"


Cheers,
Chris.

We believe that the bug you reported is fixed in the latest version of
zookeeper, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1012770@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Pierre Gruet <pgt@debian.org> (supplier of updated zookeeper package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 28 Jun 2022 18:02:04 +0200
Source: zookeeper
Architecture: source
Version: 3.8.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Pierre Gruet <pgt@debian.org>
Closes: 927673 949517 984406 990345 1001959 1012770
Changes:
 zookeeper (3.8.0-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version 3.8.0 (Closes: #927673):
     - Checking it is affected by no known security vulnerability
       (Closes: #990345)
     - Checking it does not use xml2-config anymore (Closes: #949517)
     - Checking the package does not FTBFS with gcc-11 (Closes: #984406)
   * Refreshing patches
   * Building with Maven, adapting B-D, refreshing d/rules and adapting install
     paths accordingly
   * Adapting install paths after switching to Maven
   * Updates in debian/control:
     - Depending on debhelper-compat 13
     - Removing X-Python3-Version field
     - Raising Standards version to 4.6.1 (no change)
     - Adding a Pre-Depends field in d/control for zookeeperd so that it
       pre-depends on init-system-helpers
     -  zookeeper needs to depend on default-jre, not only the headless version
   * Refreshing d/copyright
   * Updating / refreshing the packaging style:
     - New upstream signing keys
     - Rewriting d/watch, set to version 4, no repack
     - Removing debian/gbp.conf
     - Removing debian/orig-tar.sh, repacking is done via debian/copyright
     - Set upstream metadata fields: Bug-Database, Repository,
       Repository-Browse.
   * Providing patches related to the new Maven build:
     - Adding missing versions of some Maven plugins in the POM files
     - Skipping the unpackaged Timeout annotations in the tests
     - Using the ValueSource annotation with ints instead of booleans, which are
       not available in Debian-package junit5
     - Omitting the TempDir annotation in the tests, as it is not available yet
     - Correcting call to deprecated method in Bouncycastle
     -  Switching from test-jar type to tests classifier in the POM files
     - Omitting the dependency of the assembly POM on the
       zookeeper-prometheus-metrics jar, which cannot be built right now
     - Adding missing artifacts in the zookeeper-contrib-rest POM file
     - Skipping some classes because of unpackaged org.openjdk-jmh package
     - Building the Python3 artifacts without OpenSSL
     - Omitting test classes needing junit5 unpackaged classes or attempting to
       use the network
   * Correcting tiny spelling errors in the code
   * Reworking debian/rules:
     - Updating the overrides of dh_clean and dh_auto_clean
     - Stopping parsing changelog in d/rules
   * Providing an up-to-date d/libzookeeper-java.manifest file, updating
     dependencies of the binary package accordingly
   * Refreshing the doc-base files
   * Stopping providing zktreeutil, providing a NEWS file to explain this
   * Adding a NEWS entry about possible failure at startup and how to solve it
     (Closes: #1012770)
   * Adding a Lintian override for the embedded js in the javadoc
   * Adding a Lintian override for files with long lines
   * Adding missing patch headers
   * Hacking in the libtool file to prevent -rpath flags when building
   * Changing USER to NAME in d/zookeeper.postinst and d/zookeeper.postrm to be
     sure the script is doing the right thing (actually the shell uses USER for
     the logged in name)
   * Using --remove-home in d/zookeeper.postrm to ensure everything is properly
     deleted (Closes: #1001959)
Checksums-Sha1:
 fdc2e49bac0fd09e72eea2d0e5964d2db52dd344 3763 zookeeper_3.8.0-1.dsc
 c6556b6e4237f78955e3d8cd313d0ef04ed1b7e9 3485515 zookeeper_3.8.0.orig.tar.gz
 c2622953992c4495ac935662243a60c4e40d8828 488 zookeeper_3.8.0.orig.tar.gz.asc
 b2900d43f0ad3ea2bfa882ea7f59742abc25a16e 88676 zookeeper_3.8.0-1.debian.tar.xz
 282cb46c5aa0cec072a0846a489dbc95b0661513 23016 zookeeper_3.8.0-1_amd64.buildinfo
Checksums-Sha256:
 4d6fd52c05097a30c427396aec78a4ffb44c4d4e20d4073cba4b8df02d213355 3763 zookeeper_3.8.0-1.dsc
 b0c5684640bea2d8bd6610b47ff41be2aefd6c910ba48fcad5949bd2bf2fa1ac 3485515 zookeeper_3.8.0.orig.tar.gz
 22bd6c0fe38b3184cb2b7d5039392f7a63a506915b27a58328f1b4f9731ebfc3 488 zookeeper_3.8.0.orig.tar.gz.asc
 1539f248585654f13e46970940f3ff6a442f77d427d62ea2a6123bcb54cd4e4d 88676 zookeeper_3.8.0-1.debian.tar.xz
 3100ede69e765b210c5d784506a4640359b71244feeb3745edc3b39d51c1aa91 23016 zookeeper_3.8.0-1_amd64.buildinfo
Files:
 b401f5843a31789b118a1cd00bebe1f6 3763 java optional zookeeper_3.8.0-1.dsc
 dd50b329f3e17c03d2da8ed8497babb6 3485515 java optional zookeeper_3.8.0.orig.tar.gz
 0309b972507b7ef0f1851660618d090e 488 java optional zookeeper_3.8.0.orig.tar.gz.asc
 8a59fb47ca044aebf194aabcffda2964 88676 java optional zookeeper_3.8.0-1.debian.tar.xz
 ee50a3850b0e3806b5e07f4e4e5d4045 23016 java optional zookeeper_3.8.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmK7V+oACgkQYAMWptwn
dHY/AA//UAapTaviN/9VnvYtC6Z22NTvKIEbC5dJ5R7BUBMVTlTLhCIRUyOe+sJh
ZCpqeo9551kqCln0m0ZIXE3Yde9QNKevLpv6Z12mES/i78eQaadMklrVo2P1o2G/
GUDFNrskJk2n3ixIeTL6qTaPJdZBvBkEemqnQA+KUQ7kVPxU/Aw1xXOZLb513LAl
aMVp01hAgR+DRH3aiz0FLUE2BdFqRJFshr0atWd3NblB/EE/swgbku0b2gYBOnTx
I6UoBT6ztjl6MqmD8UYrFBGfCo7yLnWFkOoQISL/HKajjgAzII2Z46DOKvEpHfJY
TIn1t2SzeUXr0qPDjAN9LY/ORPMiEe6BVA2p6uLfR0F4EnzW3mkrVM97ebR5CPcp
gpgedm6n/ffKwmVp1aVjhMvK82wDt1QCv7+w+f/R3+dFiPEjgm+fEEUSYwwZhWnL
E2Z/GMvKTFAaSZ76/TBLOoguHF80VuCbCJsSWm2J9CJyMtMYv8spIUzgqQmTZgqj
MvlWS//XlMkd55t4SOjoCcjLK/LcmqLcXYjr68XA2Gb6PvnvaWddcylyOEQ8gCdH
EQm6jJz7LLhohBUB8JhcLLBCLt2RQ1ItQdIkMsQoBscRTwI1ufiDFxY2jzB7t5T4
9oiZyeZRqTmZbXRe0MrEpZqm9kXONnREfYsQ6j4sLhXxh3hm0LM=
=o+63
-----END PGP SIGNATURE-----