CVE-2019-0201

Опубликовано: 23 мая 2019

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

Ссылки

http://www.securityfocus.com/bid/108427
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:3140
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3892
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:4352
Third Party Advisory
https://issues.apache.org/jira/browse/ZOOKEEPER-1392
Issue Tracking
Patch
Vendor Advisory
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/05/msg00033.html
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/13
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190619-0001/
Third Party Advisory
https://www.debian.org/security/2019/dsa-4461
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch
Third Party Advisory
https://zookeeper.apache.org/security.html#CVE-2019-0201
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:activemq:5.15.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*

Версия от 1.0.0 (включая) до 3.4.13 (включая)

cpe:2.3:a:apache:zookeeper:3.5.0:-:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.0:rc0:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.1:-:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.1:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.1:rc0:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.1:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.1:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.1:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.1:rc4:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.2:-:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.2:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.2:rc0:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.2:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.3:-:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.3:rc0:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.3:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:zookeeper:3.5.4:beta:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:*

Версия до 19.1.0.0.1 (исключая)

cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:*

Версия до 21.5 (включая)

cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:*

Версия до 18.1.3.1.0 (исключая)

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Конфигурация 6

cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.00237

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

CVE-2019-0201

CVSS3: 5.9

ubuntu

около 6 лет назад

CVE-2019-0201

CVSS3: 7.5

redhat

около 6 лет назад

CVE-2019-0201

CVSS3: 5.9

debian

около 6 лет назад

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alph ...

GHSA-2hw2-62cp-p9p7

CVSS3: 5.9

github

около 6 лет назад

Access control bypass in Apache ZooKeeper

BDU:2020-02563

CVSS3: 5.9

fstec

около 6 лет назад

Уязвимость реализации команды getACL() централизованной службы для поддержки информации о конфигурации, именования, обеспечения распределенной синхронизации и предоставления групповых служб Apache ZooKeeper, позволяющая нарушителю раскрыть некоторые значения хеш-функции

EPSS

Процентиль: 47%

0.00237

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-862