NetSight
IP …
medium5.9

CVE-2019-0201

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta.

Impact

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Affected products

VendorProductAffected versions
ApacheActivemq
Version 5.15.9
ApacheDrill
Version 1.16.0
ApacheZookeeper
from 1.0.0 through 3.4.13
Versions 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4
DebianDebian Linux
Versions 8.0, 9.0
RedhatFuse
Version 1.0.0
OracleGoldengate Stream Analytics
before 19.1.0.0.1
OracleSiebel Core - Server Framework
through 21.5
OracleTimesten In-Memory Database
before 18.1.3.1.0
NetappHci Bootstrap Os
All versions
NetappElement Software
All versions

Weakness classification

CWE-862

References