CVE-2019-0201 Access control bypass in Apache ZooKeeper
MediumCVSS 5.9
EPSS 9.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.zookeeper/zookeeper(Maven) | >= 1.0.0, < 3.4.14 | 3.4.14 |
| org.apache.zookeeper/zookeeper(Maven) | >= 3.5.0, < 3.5.5 | 3.5.5 |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.0 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.1 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.2 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.3 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.4 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.5 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.3.6 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.0 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.1 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.10 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.11 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.12 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.13 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.2 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.3 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.4 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.5 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.6 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.7 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.8 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.9 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.1-alpha | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.2-alpha | No fix listed |
Show 37 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.3-beta | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.4-beta | No fix listed |
| debian/zookeeper(Debian:12) | < 3.4.13-2 | 3.4.13-2 |
| debian/zookeeper(Debian:13) | < 3.4.13-2 | 3.4.13-2 |
| debian/zookeeper(Debian:14) | < 3.4.13-2 | 3.4.13-2 |
| apache activemq | = 5.15.9 | No fix listed |
| apache drill | = 1.16.0 | No fix listed |
| apache zookeeper | >= 1.0.0, <= 3.4.13 | No fix listed |
| apache zookeeper | = 3.5.0 | No fix listed |
| apache zookeeper | = 3.5.0-alpha | No fix listed |
| apache zookeeper | = 3.5.0-rc0 | No fix listed |
| apache zookeeper | = 3.5.1 | No fix listed |
| apache zookeeper | = 3.5.1-alpha | No fix listed |
| apache zookeeper | = 3.5.1-rc0 | No fix listed |
| apache zookeeper | = 3.5.1-rc1 | No fix listed |
| apache zookeeper | = 3.5.1-rc2 | No fix listed |
| apache zookeeper | = 3.5.1-rc3 | No fix listed |
| apache zookeeper | = 3.5.1-rc4 | No fix listed |
| apache zookeeper | = 3.5.2 | No fix listed |
| apache zookeeper | = 3.5.2-alpha | No fix listed |
| apache zookeeper | = 3.5.2-rc0 | No fix listed |
| apache zookeeper | = 3.5.2-rc1 | No fix listed |
| apache zookeeper | = 3.5.3 | No fix listed |
| apache zookeeper | = 3.5.3-beta | No fix listed |
| apache zookeeper | = 3.5.3-rc0 | No fix listed |
| apache zookeeper | = 3.5.3-rc1 | No fix listed |
| apache zookeeper | = 3.5.4-beta | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat fuse | = 1.0.0 | No fix listed |
| oracle GoldenGate Stream Analytics | < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle siebel core - server framework | <= 21.5 | No fix listed |
| oracle timesten in-memory database | < 18.1.3.1.0 | 18.1.3.1.0 |
| netapp hci bootstrap os | All versions | No fix listed |
| netapp element software | All versions | No fix listed |
| Apache ZooKeeper | = 1.0.0 to 3.4.13 | No fix listed |
| Apache ZooKeeper | = 3.5.0-alpha to 3.5.4-beta | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- 108427 third-party-advisory vdb-entry
- issues.apache.org issue-tracking patch vendor-advisory
- zookeeper.apache.org vendor-advisory
- RHSA-2019:3140 third-party-advisory vendor-advisory
- RHSA-2019:3892 third-party-advisory vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- [debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security update mailing-list third-party-advisory
- 20190612 [SECURITY] [DSA 4461-1] zookeeper security update mailing-list third-party-advisory
- security.netapp.com third-party-advisory
- DSA-4461 third-party-advisory vendor-advisory
- RHSA-2019:4352 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- lists.apache.org
- www.oracle.com patch third-party-advisory
- github.com
- Debian Security Tracker CVE-2019-0201 vendor-advisory
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201) mailing-list
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities mailing-list
- [bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5 mailing-list
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities mailing-list
- [hadoop-common-issues] 20210816 [GitHub] [hadoop] iwasakims opened a new pull request #3308: HADOOP-17850. Upgrade ZooKeeper to 3.4.14 in branch-3.2. mailing-list
- bugs.debian.org issue-tracking