Missing authorization in Apache ZooKeeper
Priority LOW 39CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Why it matters now
EPSS 0.09712 95th percentileScored 2026-11-07
Fix Partial org.apache.zookeeper:zookeeper (Maven): 3.4.14, 3.5.5Red Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ZooKeeper | 1.0.0 to 3.4.13; 3.5.0-alpha to 3.5.4-beta | — | No fix listed | CNA |
| — | org.apache.zookeeper:zookeeper (Maven) | 1.0.0 to before 3.4.14 | 3.4.14 | Patch available | GHSA-2hw2-62cp-p9p7 |
| — | org.apache.zookeeper:zookeeper (Maven) | 3.5.0 to before 3.5.5 | 3.5.5 | Patch available | GHSA-2hw2-62cp-p9p7 |
- Apache ZooKeeper VendorApache Affected 1.0.0 to 3.4.13; 3.5.0-alpha to 3.5.4-beta Fixed in — No fix listed CNA
- org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 1.0.0 to before 3.4.14 Fixed in 3.4.14 Patch available GHSA-2hw2-62cp-p9p7
- org.apache.zookeeper:zookeeper (Maven) Vendor— Affected 3.5.0 to before 3.5.5 Fixed in 3.5.5 Patch available GHSA-2hw2-62cp-p9p7
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:activemq:5.15.9:*:*:*:*:*:*:* | 5.15.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:* | 1.16.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* | 1.0.0 – 3.4.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.0:-:*:*:*:*:*:* | 3.5.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:* | 3.5.0 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.0:rc0:*:*:*:*:*:* | 3.5.0 rc0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:-:*:*:*:*:*:* | 3.5.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:alpha:*:*:*:*:*:* | 3.5.1 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:rc0:*:*:*:*:*:* | 3.5.1 rc0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:rc1:*:*:*:*:*:* | 3.5.1 rc1 | Vulnerable | Apache |
- cpe:2.3:a:apache:activemq:5.15.9:*:*:*:*:*:*:* Versions 5.15.9 Vulnerable ·Apache
- cpe:2.3:a:apache:drill:1.16.0:*:*:*:*:*:*:* Versions 1.16.0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:* Versions 1.0.0 – 3.4.13 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.0:-:*:*:*:*:*:* Versions 3.5.0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.0:alpha:*:*:*:*:*:* Versions 3.5.0 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.0:rc0:*:*:*:*:*:* Versions 3.5.0 rc0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:-:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:alpha:*:*:*:*:*:* Versions 3.5.1 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:rc0:*:*:*:*:*:* Versions 3.5.1 rc0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:rc1:*:*:*:*:*:* Versions 3.5.1 rc1 Vulnerable ·Apache
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:zookeeper:3.5.1:rc2:*:*:*:*:*:* | 3.5.1 rc2 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:rc3:*:*:*:*:*:* | 3.5.1 rc3 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.1:rc4:*:*:*:*:*:* | 3.5.1 rc4 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.2:-:*:*:*:*:*:* | 3.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.2:alpha:*:*:*:*:*:* | 3.5.2 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.2:rc0:*:*:*:*:*:* | 3.5.2 rc0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.2:rc1:*:*:*:*:*:* | 3.5.2 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.3:-:*:*:*:*:*:* | 3.5.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:* | 3.5.3 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.3:rc0:*:*:*:*:*:* | 3.5.3 rc0 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.3:rc1:*:*:*:*:*:* | 3.5.3 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:zookeeper:3.5.4:beta:*:*:*:*:*:* | 3.5.4 beta | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:* | before 19.1.0.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:* | up to 21.5 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* | before 18.1.3.1.0 | Vulnerable | Oracle |
| cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:apache:zookeeper:3.5.1:rc2:*:*:*:*:*:* Versions 3.5.1 rc2 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:rc3:*:*:*:*:*:* Versions 3.5.1 rc3 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.1:rc4:*:*:*:*:*:* Versions 3.5.1 rc4 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.2:-:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.2:alpha:*:*:*:*:*:* Versions 3.5.2 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.2:rc0:*:*:*:*:*:* Versions 3.5.2 rc0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.2:rc1:*:*:*:*:*:* Versions 3.5.2 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.3:-:*:*:*:*:*:* Versions 3.5.3 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.3:beta:*:*:*:*:*:* Versions 3.5.3 beta Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.3:rc0:*:*:*:*:*:* Versions 3.5.3 rc0 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.3:rc1:*:*:*:*:*:* Versions 3.5.3 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:zookeeper:3.5.4:beta:*:*:*:*:*:* Versions 3.5.4 beta Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:goldengate_stream_analytics:*:*:*:*:*:*:*:* Versions before 19.1.0.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:* Versions up to 21.5 Vulnerable ·Oracle
- cpe:2.3:a:oracle:timesten_in-memory_database:*:*:*:*:*:*:*:* Versions before 18.1.3.1.0 Vulnerable ·Oracle
- cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-2hw2-62cp-p9p7 org.apache.zookeeper:zookeeper (Maven) Fixed in 3.4.14 Advisory →
- Fix · GHSA-2hw2-62cp-p9p7 org.apache.zookeeper:zookeeper (Maven) Fixed in 3.5.5 Advisory →
Red Hat 3 advisories
- RHSA-2019:4352 Released 2019-12-19 · Red Hat rating ImportantRed Hat JBoss Fuse/A-MQ 6.3 R14 security and bug fix update
- Red Hat Fuse 6.3
- RHSA-2019:3892 Released 2019-11-14 · Red Hat rating ImportantRed Hat Fuse 7.5.0 security update
- Red Hat Fuse 7.5.0
- RHSA-2019:3140 Released 2019-10-17 · Red Hat rating ImportantRed Hat JBoss Data Virtualization 6.4.8 security update
- Red Hat JBoss Data Virtualization 6.4.8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 6.3 | Fixed | RHSA-2019:4352 |
| Red Hat Fuse 7.5.0 | Fixed | RHSA-2019:3892 |
| Red Hat JBoss Data Virtualization 6.4.8 | Fixed | RHSA-2019:3140 |
Not affected: 2 products
- Red Hat OpenShift Application Runtimes
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0201
- 2026-10-03 Alias added: GHSA-2hw2-62cp-p9p7
References
Patch 4
Advisory 9
- [debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security update
- DSA-4461
- 20190612 [SECURITY] [DSA 4461-1] zookeeper security update
- RHSA-2019:3140
- RHSA-2019:3892
- RHSA-2019:4352
- https://zookeeper.apache.org/security.html#CVE-2019-0201
- https://security.netapp.com/advisory/ntap-20190619-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2019-0201
Other 15
- [bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5
- [accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201)
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities
- [hadoop-common-issues] 20210816 [GitHub] [hadoop] iwasakims opened a new pull request #3308: HADOOP-17850. Upgrade ZooKeeper to 3.4.14 in branch-3.2.
- https://security.netapp.com/advisory/ntap-20190619-0001
- https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b@%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a@%3Ccommits.accumulo.apache.org%3E
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
More Apache Activemq vulnerabilities
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
- TI-2016-02587 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-26494 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans KEVCVSS 3.1HIGH 8.8
- TI-2013-05951 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not… CVSS 3.1CRITICAL 9.8
- TI-2021-04451 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.1
- TI-2021-04446 XStream is vulnerable to an Arbitrary Code Execution attack CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-0201 · CVE Program
- CVE-2019-0201 · NVD
- FIRST EPSS
- GHSA-2hw2-62cp-p9p7 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-0201 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences