CVE-2019-0201

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

9.71% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 95.1% of scored records. A rank, not a probability.

NVD base score

5.9 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2019-05-23 13:42Z7 YR AGO

Last updated

2024-08-04 17:44Z2 YR AGO

Reserved

2018-11-14

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-862Missing AuthorizationClass
• CWE-732Incorrect Permission Assignment for Critical ResourceClass

Data version

5.1

Document digest

fdfc71538f10ebf2a461a80078caeea1a9f23e7cb3ec7c80260eafea06119687

• www.securityfocus.com108427http://www.securityfocus.com/bid/108427vdb-entryx_refsource_BID
• lists.debian.org[debian-lts-announce] 20190524 [SECURITY] [DLA 1801-1] zookeeper security updatehttps://lists.debian.org/debian-lts-announce/2019/05/msg00033.htmlmailing-listx_refsource_MLIST
• lists.apache.org[bookkeeper-issues] 20190531 [GitHub] [bookkeeper] eolivelli opened a new issue #2106: Update ZookKeeper dependency to 3.5.5https://lists.apache.org/thread.html/f6112882e30a31992a79e0a8c31ac179e9d0de7c708de3a9258d4391%40%3Cissues.bookkeeper.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[accumulo-commits] 20190605 [accumulo] branch 2.0 updated: Update ZooKeeper (CVE-2019-0201)https://lists.apache.org/thread.html/5d9a1cf41a5880557bf680b7321b4ab9a4d206c601ffb15fef6f196a%40%3Ccommits.accumulo.apache.org%3Emailing-listx_refsource_MLIST
• www.debian.orgDSA-4461https://www.debian.org/security/2019/dsa-4461vendor-advisoryx_refsource_DEBIAN
• seclists.org20190612 [SECURITY] [DSA 4461-1] zookeeper security updatehttps://seclists.org/bugtraq/2019/Jun/13mailing-listx_refsource_BUGTRAQ
• lists.apache.org[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jarhttps://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Emailing-listx_refsource_MLIST
• access.redhat.comRHSA-2019:3140https://access.redhat.com/errata/RHSA-2019:3140vendor-advisoryx_refsource_REDHAT
• lists.apache.org[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitieshttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitieshttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitieshttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Emailing-listx_refsource_MLIST
• access.redhat.comRHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:3892vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2019:4352https://access.redhat.com/errata/RHSA-2019:4352vendor-advisoryx_refsource_REDHAT
• www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
• issues.apache.orghttps://issues.apache.org/jira/browse/ZOOKEEPER-1392x_refsource_MISC
• zookeeper.apache.orghttps://zookeeper.apache.org/security.html#CVE-2019-0201x_refsource_CONFIRM
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20190619-0001/x_refsource_CONFIRM
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
• www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.htmlx_refsource_MISC
• lists.apache.org[hadoop-common-issues] 20210816 [GitHub] [hadoop] iwasakims opened a new pull request #3308: HADOOP-17850. Upgrade ZooKeeper to 3.4.14 in branch-3.2.https://lists.apache.org/thread.html/r40f32125c1d97ad82404cc918171d9e0fcf78e534256674e9da1eb4b%40%3Ccommon-issues.hadoop.apache.org%3Emailing-listx_refsource_MLIST