VYPR
← All advisories
Moderate severityNVD Advisory· Published May 23, 2019· Updated Aug 4, 2024

CVE-2019-0201

CVE-2019-0201

Description

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache ZooKeeper's getACL() command discloses unsalted password hashes to unauthenticated users, enabling offline cracking in Digest Authentication mode.

Apache ZooKeeper versions 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta contain an information disclosure vulnerability in the getACL() command. The command does not enforce any permission check when retrieving the ACLs of a requested node, returning all information contained in the ACL Id field as plaintext string [1]. When Digest Authentication is in use, DigestAuthenticationProvider overloads the Id field with the unsalted hash value used for user authentication, causing that hash to be exposed [1].

An unauthenticated or unprivileged attacker with network access to a ZooKeeper server can issue a getACL() request on any node to obtain the unsalted hash of a user's password. No prior authentication or special privileges are required, making the attack surface broad for any client that can reach the ZooKeeper port [1].

The disclosed unsalted hash can be used in offline brute-force or dictionary attacks to recover the plaintext password. Successful password recovery compromises the authentication mechanism, potentially allowing attackers to impersonate legitimate users and gain unauthorized access to ZooKeeper resources [1].

The vulnerability is fixed in Apache ZooKeeper versions 3.4.14 and 3.5.5 [3]. Red Hat has also issued security updates for affected products, including Red Hat Enterprise Linux (RHSA-2019:3892) and Red Hat JBoss Data Virtualization (RHSA-2019:3140) [2][4]. Users are strongly advised to upgrade to patched versions or apply the relevant vendor updates.

References
  1. NVD - CVE-2019-0201
  2. https://access.redhat.com/errata/RHSA-2019:3892
  3. Apache ZooKeeper
  4. https://access.redhat.com/errata/RHSA-2019:3140

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.zookeeper:zookeeperMaven
>= 1.0.0, < 3.4.143.4.14
org.apache.zookeeper:zookeeperMaven
>= 3.5.0, < 3.5.53.5.5

Affected products

233

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

30

News mentions

0

No linked articles in our index yet.