CVE-2019-0201
Medium
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
SeverityMedium
CVSS5.9
Exploit probability96. percentile9.7%
Product
Apache Zookeeper
PublishedMay 23, 2019
First seenMay 23, 2019
How to fix
Update
- oracle goldengate_stream_analytics19.1.0.0.1 or later
- oracle timesten_in-memory_database18.1.3.1.0 or later
- org.apache.zookeeper:zookeeper3.4.14, 3.5.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache zookeeper | 1.0.0 ≤ v ≤ 3.4.13, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4 | — |
| apache activemq | 5.15.9 | — |
| apache drill | 1.16.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
| redhat fuse | 1.0.0 | — |
| oracle goldengate_stream_analytics | v < 19.1.0.0.1 | 19.1.0.0.1 |
| oracle siebel_core_-_server_framework | v ≤ 21.5 | — |
| oracle timesten_in-memory_database | v < 18.1.3.1.0 | 18.1.3.1.0 |
| netapp hci_bootstrap_os | No range specified | — |
| netapp element_software | No range specified | — |
| org.apache.zookeeper:zookeeperMaven | 1.0.0 ≤ v < 3.4.14, 3.5.0 ≤ v < 3.5.5 | 3.4.14, 3.5.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.