Access Control Vulnerability in Apache ZooKeeper by Apache Software Foundation

CVE-2019-0201

What is CVE-2019-0201?

An access control issue has been identified in Apache ZooKeeper versions 1.0.0 through 3.4.13 and from 3.5.0-alpha to 3.5.4-beta. The vulnerability allows the getACL() command to be executed without verifying permissions, inadvertently revealing the ACLs in a plaintext format. Specifically, this flaw affects the Id field in the DigestAuthenticationProvider, which uses unsalted hash values for user authentication. As a result, unauthenticated or unprivileged users may gain access to sensitive authentication data, leading to potential security breaches.

References