CVE-2019-0201
Apache Software Foundation Apache ZooKeeper
MEDIUM 5.9
En bref
- Source
- NVD
- EPSS
- EPSS 9.71 % · centile 95 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Modified
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
- http://www.securityfocus.com/bid/108427
- https://lists.debian.org/debian-lts-announce/2019/05/msg00033.html
- https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E
- https://www.debian.org/security/2019/dsa-4461
- https://seclists.org/bugtraq/2019/Jun/13
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3140
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4352
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://issues.apache.org/jira/browse/ZOOKEEPER-1392
- https://zookeeper.apache.org/security.html#CVE-2019-0201
- https://security.netapp.com/advisory/ntap-20190619-0001/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3E
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-2hw2-62cp-p9p7 — Access control bypass in Apache ZooKeeper
Références européennes
- ENISA EUVD · EUVD-2019-0443
- GCVE · GCVE-0-2019-0201
Avis du CERT-FR
- CERTFR-2020-AVI-587 — Vulnérabilité dans IBM Qradar · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:activemq:5.15.9:*:*:*:*:*:*:*cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*≥ 1.0.0 ≤ 3.4.13cpe:2.3:a:apache:zookeeper:3.5.0:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.0:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:alpha:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc1:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc2:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc3:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.1:rc4:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:alpha:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.2:rc1:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:-:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:rc0:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.3:rc1:*:*:*:*:*:*cpe:2.3:a:apache:zookeeper:3.5.4:beta:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*< 19.1.0.0.1cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:*≤ 21.5cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*< 18.1.3.1.0cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache ZooKeeper | affected 1.0.0 to 3.4.13 ; affected 3.5.0-alpha to 3.5.4-beta |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |