CVE-2019-0201
Apache Software Foundation Apache ZooKeeper
MEDIUM 5.9
At a glance
- Source
- NVD
- EPSS
- EPSS 9.71 % · percentile 95 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
- http://www.securityfocus.com/bid/108427
- https://lists.debian.org/debian-lts-announce/2019/05/msg00033.html
- https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E
- https://www.debian.org/security/2019/dsa-4461
- https://seclists.org/bugtraq/2019/Jun/13
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3140
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4352
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://issues.apache.org/jira/browse/ZOOKEEPER-1392
- https://zookeeper.apache.org/security.html#CVE-2019-0201
- https://security.netapp.com/advisory/ntap-20190619-0001/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3E
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-2hw2-62cp-p9p7 — Access control bypass in Apache ZooKeeper
European references
- ENISA EUVD · EUVD-2019-0443
- GCVE · GCVE-0-2019-0201
CERT-FR advisories
- CERTFR-2020-AVI-587 — Vulnérabilité dans IBM Qradar · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:activemq:5.15.9:*:*:*:*:*:*:*cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*≥ 1.0.0 ≤ 3.4.13cpe:2.3:a:apache:zookeeper:3.5.0:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.0:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:alpha:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc1:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc2:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc3:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc4:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:alpha:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:rc1:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:rc1:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.4:beta:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*< 19.1.0.0.1cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:*≤ 21.5cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*< 18.1.3.1.0cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache ZooKeeper | affected 1.0.0 to 3.4.13 ; affected 3.5.0-alpha to 3.5.4-beta |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |