CVE-2019-0201

Name	CVE-2019-0201
Description	An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1801-1, DSA-4461-1, ELA-119-1
Debian Bugs	929283

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
zookeeper (PTS)	jessie, jessie (lts)	3.4.9-3+deb8u2	fixed
	stretch (security), stretch (lts), stretch	3.4.9-3+deb9u2	fixed
	buster (security), buster, buster (lts)	3.4.13-2+deb10u1	fixed
	bullseye (security), bullseye	3.4.13-6+deb11u1	fixed
	bookworm (security), bookworm	3.8.0-11+deb12u1	fixed
	sid, trixie	3.9.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
zookeeper	source	wheezy	3.4.5+dfsg-2+deb7u2	ELA-119-1
zookeeper	source	jessie	3.4.9-3+deb8u2	DLA-1801-1
zookeeper	source	stretch	3.4.9-3+deb9u2	DSA-4461-1
zookeeper	source	(unstable)	3.4.13-2		929283

Notes

https://issues.apache.org/jira/browse/ZOOKEEPER-1392
Patch (3.4 branch): https://gitbox.apache.org/repos/asf?p=zookeeper.git;a=commit;h=5ff19e3672987bdde2843a3f031e2bf0010e35f1