CVE-2019-0201
- State
- Published
- Severity
- Not scored
- Published
- May 23, 2019
- Updated
- Aug 4, 2024
- Reserved
- Nov 14, 2018
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache ZooKeeperApache Software Foundation |
|
References
- 108427vdb-entry
- [debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security updatemailing-list
- [bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5mailing-list
- [accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201)mailing-list
- DSA-4461vendor-advisory
- 20190612 [SECURITY] [DSA 4461-1] zookeeper security updatemailing-list
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jarmailing-list
- RHSA-2019:3140vendor-advisory
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- RHSA-2019:3892vendor-advisory
- RHSA-2019:4352vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://issues.apache.org/jira/browse/ZOOKEEPER-1392
- https://zookeeper.apache.org/security.html#CVE-2019-0201
- https://security.netapp.com/advisory/ntap-20190619-0001/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- [hadoop-common-issues] 20210816 [GitHub] [hadoop] iwasakims opened a new pull request #3308: HADOOP-17850. Upgrade ZooKeeper to 3.4.14 in branch-3.2.mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.