CVE-2019-0201

Published: May 23, 2019Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Affected (30)

Products: Apache: Activemq, Drill, Zookeeper · Debian: Debian Linux · Redhat: Fuse · +2 more

Show all products

Apache: Activemq, Drill, Zookeeper · Debian: Debian Linux · Redhat: Fuse · Oracle: Goldengate Stream Analytics, Siebel Core Server Framework, Timesten In Memory Database · Netapp: Hci Bootstrap Os, Element Software

3 products

1 product

1 product

3 products

Goldengate Stream Analytics

Siebel Core Server Framework

Timesten In Memory Database

Netapp

2 products

Hci Bootstrap Os

Element Software

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Apache Activemq	Version 5.15.9
Apache Drill	Version 1.16.0
Apache Zookeeper	From 1.0.0 to 3.4.13
Apache Zookeeper	Version 3.5.0
Apache Zookeeper	Version 3.5.0 alpha
Apache Zookeeper	Version 3.5.0 rc0
Apache Zookeeper	Version 3.5.1
Apache Zookeeper	Version 3.5.1 alpha
Apache Zookeeper	Version 3.5.1 rc0
Apache Zookeeper	Version 3.5.1 rc1
Apache Zookeeper	Version 3.5.1 rc2
Apache Zookeeper	Version 3.5.1 rc3
Apache Zookeeper	Version 3.5.1 rc4
Apache Zookeeper	Version 3.5.2
Apache Zookeeper	Version 3.5.2 alpha
Apache Zookeeper	Version 3.5.2 rc0
Apache Zookeeper	Version 3.5.2 rc1
Apache Zookeeper	Version 3.5.3
Apache Zookeeper	Version 3.5.3 beta
Apache Zookeeper	Version 3.5.3 rc0
Apache Zookeeper	Version 3.5.3 rc1
Apache Zookeeper	Version 3.5.4 beta

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Fuse	Version 1.0.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Goldengate Stream Analytics	Before 19.1.0.0.1
Oracle Siebel Core Server Framework	Up to 21.5
Oracle Timesten In Memory Database	Before 18.1.3.1.0

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Hci Bootstrap Os	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Element Software	All versions

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (40)

http://www.securityfocus.com/bid/108427

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:3140

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3892

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:4352

Source: security@apache.org

Third Party Advisory

https://issues.apache.org/jira/browse/ZOOKEEPER-1392

Source: security@apache.org

Issue TrackingPatchVendor Advisory

https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2019/05/msg00033.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2019/Jun/13

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20190619-0001/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4461

Source: security@apache.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: security@apache.org

PatchThird Party Advisory

https://zookeeper.apache.org/security.html#CVE-2019-0201

Source: security@apache.org

Vendor Advisory

http://www.securityfocus.com/bid/108427