UBUNTU-CVE-2019-0201

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2019-0201
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-0201.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-0201
Related
Published
2019-05-23T14:29:00Z
Modified
2019-05-23T14:29:00Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

References

Affected packages

Ubuntu:Pro:14.04:LTS / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/ubuntu/zookeeper@3.4.5+dfsg-1ubuntu0.1~esm3?arch=src?distro=trusty/esm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.5+dfsg-1ubuntu0.1~esm3

Affected versions

3.*

3.4.5+dfsg-1
3.4.5+dfsg-1ubuntu0.1~esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libzookeeper-mt2": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "zookeeperd": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "python-zookeeper": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper-st2-dbgsym": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "zookeeper-bin-dbgsym": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper-mt-dev": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper-java": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper2": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper-java-doc": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper-st2": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "zookeeper-bin": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "python-zookeeper-dbgsym": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper-mt2-dbgsym": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "zookeeper": "3.4.5+dfsg-1ubuntu0.1~esm3",
            "libzookeeper-st-dev": "3.4.5+dfsg-1ubuntu0.1~esm3"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/ubuntu/zookeeper@3.4.8-1ubuntu0.1~esm2?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.8-1ubuntu0.1~esm2

Affected versions

3.*

3.4.6-8
3.4.7-1
3.4.8-1
3.4.8-1ubuntu0.1~esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libzookeeper-mt2": "3.4.8-1ubuntu0.1~esm2",
            "zookeeperd": "3.4.8-1ubuntu0.1~esm2",
            "python-zookeeper": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper-st2-dbgsym": "3.4.8-1ubuntu0.1~esm2",
            "zookeeper-bin-dbgsym": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper-mt-dev": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper-java": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper2": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper-java-doc": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper-st2": "3.4.8-1ubuntu0.1~esm2",
            "zookeeper-bin": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper-mt2-dbgsym": "3.4.8-1ubuntu0.1~esm2",
            "zookeeper": "3.4.8-1ubuntu0.1~esm2",
            "libzookeeper-st-dev": "3.4.8-1ubuntu0.1~esm2"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/ubuntu/zookeeper@3.4.13-3?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.13-3

Affected versions

3.*

3.4.10-2
3.4.10-3

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libzookeeper-mt2": "3.4.13-3",
            "zookeeperd": "3.4.13-3",
            "python-zookeeper": "3.4.13-3",
            "libzookeeper-st2-dbgsym": "3.4.13-3",
            "zookeeper-bin-dbgsym": "3.4.13-3",
            "libzookeeper-mt-dev": "3.4.13-3",
            "libzookeeper-java": "3.4.13-3",
            "libzookeeper-java-doc": "3.4.13-3",
            "libzookeeper-st2": "3.4.13-3",
            "zookeeper-bin": "3.4.13-3",
            "python-zookeeper-dbgsym": "3.4.13-3",
            "libzookeeper-mt2-dbgsym": "3.4.13-3",
            "zookeeper": "3.4.13-3",
            "libzookeeper-st-dev": "3.4.13-3"
        }
    ]
}

Ubuntu:20.04:LTS / zookeeper

Package

Name
zookeeper
Purl
pkg:deb/ubuntu/zookeeper@3.4.13-3?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.13-3

Affected versions

3.*

3.4.13-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libzookeeper-mt2": "3.4.13-3",
            "zookeeperd": "3.4.13-3",
            "python-zookeeper": "3.4.13-3",
            "libzookeeper-st2-dbgsym": "3.4.13-3",
            "zookeeper-bin-dbgsym": "3.4.13-3",
            "libzookeeper-mt-dev": "3.4.13-3",
            "libzookeeper-java": "3.4.13-3",
            "libzookeeper-java-doc": "3.4.13-3",
            "libzookeeper-st2": "3.4.13-3",
            "zookeeper-bin": "3.4.13-3",
            "python-zookeeper-dbgsym": "3.4.13-3",
            "libzookeeper-mt2-dbgsym": "3.4.13-3",
            "zookeeper": "3.4.13-3",
            "libzookeeper-st-dev": "3.4.13-3"
        }
    ]
}