Non notée
CVE-2019-0201 An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache ZooKeeper | Versions non publiées |
Références
- 108427 www.securityfocus.com
- [debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security update lists.debian.org
- [bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5 lists.apache.org
- [accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201) lists.apache.org
- DSA-4461 www.debian.org
- 20190612 [SECURITY] [DSA 4461-1] zookeeper security update seclists.org
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar lists.apache.org
- RHSA-2019:3140 access.redhat.com
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities lists.apache.org
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- RHSA-2019:3892 access.redhat.com
- RHSA-2019:4352 access.redhat.com
- www.oracle.com www.oracle.com
- issues.apache.org issues.apache.org
- zookeeper.apache.org zookeeper.apache.org
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- [hadoop-common-issues] 20210816 [GitHub] [hadoop] iwasakims opened a new pull request #3308: HADOOP-17850. Upgrade ZooKeeper to 3.4.14 in branch-3.2. lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache ZooKeeper
Les 19 CVE de Apache ZooKeeper →
CVE-2026-100302
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
7.1
Élevée
CVE-2026-115448
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
8.7
Élevée
CVE-2026-100300
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
8.7
Élevée
CVE-2026-100252
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
8.6
Élevée