Non notée
CVE-2019-0201 An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta
Description
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache ZooKeeper | Versions non publiées |
Autres CVE de Apache ZooKeeper
Les 19 CVE de Apache ZooKeeper →
CVE-2026-100302
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
7.1
Élevée
CVE-2026-115448
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
8.7
Élevée
CVE-2026-100300
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
8.7
Élevée
CVE-2026-100252
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
8.6
Élevée