CVE-2019-0201

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 23-05-2019 04:29

Last modified: - 19-04-2022 05:35

Total changes: - 6

Description

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

High

Attack complexity

Network

Attack vector

None

Availability

High

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

5.9

Base score

2.2

3.6

Exploitability score

Impact score

Verification logic

vendor=apache AND product=activemq AND version=5.15.9

vendor=apache AND product=drill AND version=1.16.0

vendor=apache AND product=zookeeper AND versionEndIncluding=3.4.13 AND versionStartIncluding=1.0.0

vendor=apache AND product=zookeeper AND version=3.5.0 AND update=-

vendor=apache AND product=zookeeper AND version=3.5.0 AND update=alpha

vendor=apache AND product=zookeeper AND version=3.5.0 AND update=rc0

vendor=apache AND product=zookeeper AND version=3.5.1 AND update=-

vendor=apache AND product=zookeeper AND version=3.5.1 AND update=alpha

vendor=apache AND product=zookeeper AND version=3.5.1 AND update=rc0

vendor=apache AND product=zookeeper AND version=3.5.1 AND update=rc1

vendor=apache AND product=zookeeper AND version=3.5.1 AND update=rc2

vendor=apache AND product=zookeeper AND version=3.5.1 AND update=rc3

vendor=apache AND product=zookeeper AND version=3.5.1 AND update=rc4

vendor=apache AND product=zookeeper AND version=3.5.2 AND update=-

vendor=apache AND product=zookeeper AND version=3.5.2 AND update=alpha

vendor=apache AND product=zookeeper AND version=3.5.2 AND update=rc0

vendor=apache AND product=zookeeper AND version=3.5.2 AND update=rc1

vendor=apache AND product=zookeeper AND version=3.5.3 AND update=-

vendor=apache AND product=zookeeper AND version=3.5.3 AND update=beta

vendor=apache AND product=zookeeper AND version=3.5.3 AND update=rc0

vendor=apache AND product=zookeeper AND version=3.5.3 AND update=rc1

vendor=apache AND product=zookeeper AND version=3.5.4 AND update=beta

vendor=Debian AND product=debian_linux AND version=8.0

vendor=Debian AND product=debian_linux AND version=9.0

vendor=Red Hat Enterprise Linux AND product=fuse AND version=1.0.0

vendor=oracle AND product=goldengate_stream_analytics AND versionEndExcluding=19.1.0.0.1

vendor=oracle AND product=siebel_core_-_server_framework AND versionEndIncluding=21.5

vendor=oracle AND product=timesten_in-memory_database AND versionEndExcluding=18.1.3.1.0

AND

vendor=netapp AND product=hci_bootstrap_os AND version=-

vendor=netapp AND product=hci_compute_node AND version=-

vendor=netapp AND product=element_software AND version=-

Reference

https://zookeeper.apache.org/security.html#CVE-2019-0201
https://issues.apache.org/jira/browse/ZOOKEEPER-1392
108427-Third Party Advisory, VDB Entry
[debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security update-Mailing List, Third Party Advisory
[bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5-Mailing List, Vendor Advisory
[accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201)-Mailing List, Patch, Vendor Advisory
DSA-4461-Third Party Advisory
20190612 [SECURITY] [DSA 4461-1] zookeeper security update-Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190619-0001/
[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar-Mailing List, Vendor Advisory
RHSA-2019:3140-Third Party Advisory
[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities-Mailing List, Vendor Advisory
[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities-Mailing List, Vendor Advisory
[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities-Mailing List, Vendor Advisory
RHSA-2019:3892-Third Party Advisory
RHSA-2019:4352-Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
N/A-Patch, Third Party Advisory
[hadoop-common-issues] 20210816 [GitHub] [hadoop] iwasakims opened a new pull request #3308: HADOOP-17850. Upgrade ZooKeeper to 3.4.14 in branch-3.2.-Mailing List, Vendor Advisory

Keywords

CVE-2019-0201

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2019-0201

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures