PT-2019-5356 · Apache+3 · Apache Zookeeper+3

Published 2019-05-23 · Updated 2024-08-15 · CVE-2019-0201

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions 1.0.0 through 3.4.13 Apache ZooKeeper versions 3.5.0-alpha through 3.5.4-beta

Description The issue is related to ZooKeeper’s getACL() command, which does not check any permission when retrieving the ACLs of the requested node and returns all information contained in the ACL Id field as a plaintext string. The DigestAuthenticationProvider overloads the Id field with the hash value used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by a getACL() request for unauthenticated or unprivileged users.

Recommendations For Apache ZooKeeper versions 1.0.0 through 3.4.13, consider disabling the DigestAuthenticationProvider to prevent the disclosure of unsalted hash values until a patch is available. For Apache ZooKeeper versions 3.5.0-alpha through 3.5.4-beta, consider restricting access to the getACL() command to prevent unauthenticated or unprivileged users from retrieving sensitive information until a patch is available. As a temporary workaround, consider disabling the getACL() command until a patch is available.

Fix

Incorrect Permission

Missing Authorization

Weakness Enumeration

CWE-732

CWE-275

CWE-862

Related Identifiers

BDU:2020-02563

CVE-2019-0201

DLA-1801-1

DSA-4461-1

GHSA-2HW2-62CP-P9P7

SUSE-RU-2020:2072-1

SUSE-SU-2020:1066-1

SUSE-SU-2020:1190-1

USN-6559-1

Affected Products

Apache Zookeeper

Linuxmint

Red Os

Ubuntu

References · 154

• https://ubuntu.com/security/CVE-2023-44981 · Vendor Advisory
• https://issues.apache.org/jira/browse/ZOOKEEPER-1392 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6559-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3892 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:4352 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3140 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6559-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-0201 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-0201 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-0201 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2020:2072-1 · Vendor Advisory
• https://zookeeper.apache.org/security.html#CVE-2019-0201 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1801-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Patch