CVE-2019-0201: Medium severity Apache ActiveMQ vulnerability
A flaw was found in Apache ZooKeeper. A lack of permission checks while retrieving ACLs allows unsalted hash values to be disclosed for unauthenticated or unprivileged users.
Other sources
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
— Ubuntu
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper's getACL() command doesn't check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
References: http://www.securityfocus.com/bid/108427 https://issues.apache.org/jira/browse/ZOOKEEPER-1392 https://zookeeper.apache.org/security.html#CVE-2019-0201
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/zookeeperto a version that resolves this vulnerability.Fixed in 3.4.8-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/zookeeperto a version that resolves this vulnerability.Fixed in 3.4.5+dfsg-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/zookeeperto a version that resolves this vulnerability.Fixed in 3.4.9-3+ - Upgrade
Upgrade
debian/zookeeperto a version that resolves this vulnerability.Fixed in 3.4.13-2Fixed in 3.4.13-2+deb10u1Fixed in 3.4.13-6+deb11u1Fixed in 3.8.0-11+deb12u1Fixed in 3.9.1-1 - Upgrade
Upgrade
redhat/zookeeperto a version that resolves this vulnerability.Fixed in 3.6.0 - Upgrade
Upgrade
redhat/zookeeperto a version that resolves this vulnerability.Fixed in 3.5.5 - Upgrade
Upgrade
redhat/zookeeperto a version that resolves this vulnerability.Fixed in 3.4.14 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.4.14 - Upgrade
Upgrade
Apache ZooKeeperto a version that resolves this vulnerability.Fixed in 3.5.5 - Configuration
If Digest Authentication is in use, switch to an authentication method other than Digest (e.g., Kerberos) to avoid disclosure of unsalted hash values via getACL().
Apache ZooKeeper (DigestAuthenticationProvider) authentication_method = Use an authentication method other than Digest (e.g., Kerberos)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2019-0201.
What is the severity of CVE-2019-0201?
The severity of CVE-2019-0201 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-0201?
Apache ZooKeeper versions from 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta are affected by CVE-2019-0201.
How can I fix the CVE-2019-0201 vulnerability?
To fix the CVE-2019-0201 vulnerability, update your Apache ZooKeeper software to version 3.4.14, 3.5.5, or later.
Where can I find more information about CVE-2019-0201?
More information about CVE-2019-0201 can be found at the following references: [1](http://www.securityfocus.com/bid/108427), [2](https://issues.apache.org/jira/browse/ZOOKEEPER-1392), [3](https://zookeeper.apache.org/security.html#CVE-2019-0201).