CVE-2020-35211: Unauthorized Atomix Nodes can Become Lead Node in Atomix v3.1.5
Summary
CVE-2020-35211: An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node. Affects io.atomix:atomix versions < 3.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Atomix is a Maven package that provides a distributed coordination framework for building fault-tolerant and highly available applications. It utilizes the Raft consensus algorithm to ensure consistency and fault tolerance in distributed systems. The vulnerability identified in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster by manipulating the variable terms in RaftContext.
Vulnerability Detail
The vulnerability in Atomix v3.1.5 enables unauthorized Atomix nodes to take control as the lead node within a cluster. By manipulating the variable terms in RaftContext, an attacker can gain unauthorized access and potentially disrupt the cluster's operations. This can lead to a loss of data consistency and availability, compromising the integrity and reliability of the distributed system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of Atomix.
Conclusion
In conclusion, the vulnerability in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a cluster, potentially compromising data consistency and availability. To mitigate this vulnerability, it is crucial to upgrade to a patched version of Atomix beyond 3.1.5. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.atomix:atomix →
FAQ
Atomix is a distributed coordination framework for building fault-tolerant and highly available applications.
The vulnerability allows unauthorized Atomix nodes to become the lead node in a cluster, potentially compromising data consistency and availability.
To fix this vulnerability, upgrade to a patched version of Atomix beyond 3.1.5.
No, there is no known workaround. Upgrading to a patched version is the recommended solution.
For more information, you can refer to the GitHub advisory database and the provided CVE identifier.
Related vulnerabilities
Recent vulnerabilities recorded for io.atomix:atomix.
