CVE-2019-0201
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeepers getACL() command doesnt check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Risk Information
Base Score
5.9
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.216
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2019-0201 are fixed in Apache-zookeeper 3.4.14 | Windows |
| Vulnerabilities CVE-2019-0201 are fixed in Apache-zookeeper 3.5.5 | Windows |
| Multiple Vulnerabilities are affected in IBM Security Guardium 11.4 | Windows |
| Multiple Vulnerabilities are affected in IBM Security Guardium 11.5 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.6 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.4 | Windows |
| zookeeper security update(DSA-4461-1) zookeeper_3.4.9-3+deb9u2_all.deb | Linux |
| High-performance coordination service for distributed applications (USN-6559-1) libzookeeper-java_3.4.13-5ubuntu0.1_all.deb | Linux |
| High-performance coordination service for distributed applications (USN-6559-1) libzookeeper-java_3.4.13-6ubuntu4.1_all.deb | Linux |
| High-performance coordination service for distributed applications (USN-6559-1) libzookeeper-java_3.8.0-10ubuntu0.1_all.deb | Linux |
| High-performance coordination service for distributed applications (USN-6559-1) libzookeeper-java_3.8.0-11ubuntu0.1_all.deb | Linux |
| Vulnerabilities CVE-2019-0201 are fixed in Apache-zookeeper for Linux 3.4.14 | Linux |
| Vulnerabilities CVE-2019-0201 are fixed in Apache-zookeeper for Linux 3.5.5 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234