CVE-2019-0201: Medium severity Apache ActiveMQ vulnerability
A flaw was found in Apache ZooKeeper. A lack of permission checks while retrieving ACLs allows unsalted hash values to be disclosed for unauthenticated or unprivileged users.
Other sources
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
— Ubuntu
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper's getACL() command doesn't check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
References: http://www.securityfocus.com/bid/108427 https://issues.apache.org/jira/browse/ZOOKEEPER-1392 https://zookeeper.apache.org/security.html#CVE-2019-0201
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2019-0201.
What is the severity of CVE-2019-0201?
The severity of CVE-2019-0201 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-0201?
Apache ZooKeeper versions from 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta are affected by CVE-2019-0201.
How can I fix the CVE-2019-0201 vulnerability?
To fix the CVE-2019-0201 vulnerability, update your Apache ZooKeeper software to version 3.4.14, 3.5.5, or later.
Where can I find more information about CVE-2019-0201?
More information about CVE-2019-0201 can be found at the following references: [1](http://www.securityfocus.com/bid/108427), [2](https://issues.apache.org/jira/browse/ZOOKEEPER-1392), [3](https://zookeeper.apache.org/security.html#CVE-2019-0201).