ByteOS Network

CVE Vulnerability Details :

CVE-2019-0201

PUBLISHED

More Info Official Page

Assigner-apache

Assigner Org ID-f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At-23 May, 2019 | 13:42

Updated At-04 Aug, 2024 | 17:44

▼CVE Numbering Authority (CNA)

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Affected Products

Vendor

The Apache Software Foundation

Product

Apache ZooKeeper

Versions

Affected

1.0.0 to 3.4.13
3.5.0-alpha to 3.5.4-beta

Problem Types

Type	CWE ID	Description
text	N/A	Information Disclosure

Type: text

CWE ID: N/A

Description: Information Disclosure

References

Hyperlink	Resource
http://www.securityfocus.com/bid/108427	vdb-entry x_refsource_BID
https://lists.debian.org/debian-lts-announce/2019/05/msg00033.html	mailing-list x_refsource_MLIST
https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3E	mailing-list x_refsource_MLIST
https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E	mailing-list x_refsource_MLIST
https://www.debian.org/security/2019/dsa-4461	vendor-advisory x_refsource_DEBIAN
https://seclists.org/bugtraq/2019/Jun/13	mailing-list x_refsource_BUGTRAQ
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E	mailing-list x_refsource_MLIST
https://access.redhat.com/errata/RHSA-2019:3140	vendor-advisory x_refsource_REDHAT
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E	mailing-list x_refsource_MLIST
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E	mailing-list x_refsource_MLIST
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E	mailing-list x_refsource_MLIST
https://access.redhat.com/errata/RHSA-2019:3892	vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:4352	vendor-advisory x_refsource_REDHAT
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
https://issues.apache.org/jira/browse/ZOOKEEPER-1392	x_refsource_MISC
https://zookeeper.apache.org/security.html#CVE-2019-0201	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20190619-0001/	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3E	mailing-list x_refsource_MLIST

Hyperlink: http://www.securityfocus.com/bid/108427

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://lists.debian.org/debian-lts-announce/2019/05/msg00033.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://www.debian.org/security/2019/dsa-4461

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: https://seclists.org/bugtraq/2019/Jun/13

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://access.redhat.com/errata/RHSA-2019:3140

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://access.redhat.com/errata/RHSA-2019:3892

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2019:4352

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://www.oracle.com/security-alerts/cpujul2020.html

Resource:

x_refsource_MISC

Hyperlink: https://issues.apache.org/jira/browse/ZOOKEEPER-1392

Resource:

x_refsource_MISC

Hyperlink: https://zookeeper.apache.org/security.html#CVE-2019-0201

Resource:

x_refsource_CONFIRM

Hyperlink: https://security.netapp.com/advisory/ntap-20190619-0001/

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2020.html

Resource:

x_refsource_MISC

Hyperlink: https://www.oracle.com//security-alerts/cpujul2021.html

Resource:

x_refsource_MISC

Hyperlink: https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.securityfocus.com/bid/108427	vdb-entry x_refsource_BID x_transferred
https://lists.debian.org/debian-lts-announce/2019/05/msg00033.html	mailing-list x_refsource_MLIST x_transferred
https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://www.debian.org/security/2019/dsa-4461	vendor-advisory x_refsource_DEBIAN x_transferred
https://seclists.org/bugtraq/2019/Jun/13	mailing-list x_refsource_BUGTRAQ x_transferred
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://access.redhat.com/errata/RHSA-2019:3140	vendor-advisory x_refsource_REDHAT x_transferred
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
https://access.redhat.com/errata/RHSA-2019:3892	vendor-advisory x_refsource_REDHAT x_transferred
https://access.redhat.com/errata/RHSA-2019:4352	vendor-advisory x_refsource_REDHAT x_transferred
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC x_transferred
https://issues.apache.org/jira/browse/ZOOKEEPER-1392	x_refsource_MISC x_transferred
https://zookeeper.apache.org/security.html#CVE-2019-0201	x_refsource_CONFIRM x_transferred
https://security.netapp.com/advisory/ntap-20190619-0001/	x_refsource_CONFIRM x_transferred
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC x_transferred
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC x_transferred
https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3E	mailing-list x_refsource_MLIST x_transferred