{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Stackable GmbH and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "product-security@stackable.tech",
      "issuing_authority": "The Stackable Security Team is responsible for vulnerability handling across all Stackable offerings.",
      "name": "Stackable GmbH",
      "namespace": "https://www.stackable.tech/"
    },
    "title": "Stackable Security Advisory for: CVE-2019-0201",
    "tracking": {
      "current_release_date": "2026-10-19T21:25:49.393527Z",
      "generator": {
        "engine": {
          "name": "SecObserve",
          "version": "1.60.1"
        }
      },
      "id": "CVE-2019-0201",
      "initial_release_date": "2026-10-19T21:25:49.393527Z",
      "revision_history": [
        {
          "date": "2026-10-19T21:25:49.393527Z",
          "number": "1",
          "summary": "Initial release"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "3.1.3-stackable26.3.0-amd64",
                    "product": {
                      "name": "hive:3.1.3-stackable26.3.0-amd64",
                      "product_id": "pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
                      "product_identification_helper": {
                        "purl": "pkg:oci/hive@sha256:127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech/sdp/hive"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.1.3-stackable26.7.0-amd64",
                    "product": {
                      "name": "hive:3.1.3-stackable26.7.0-amd64",
                      "product_id": "pkg:oci/hive@sha256%3A1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
                      "product_identification_helper": {
                        "purl": "pkg:oci/hive@sha256:1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech/sdp/hive"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "hive"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "2.6.0-stackable26.3.0-amd64",
                    "product": {
                      "name": "nifi:2.6.0-stackable26.3.0-amd64",
                      "product_id": "pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
                      "product_identification_helper": {
                        "purl": "pkg:oci/nifi@sha256:6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.6.0-stackable26.7.0-amd64",
                    "product": {
                      "name": "nifi:2.6.0-stackable26.7.0-amd64",
                      "product_id": "pkg:oci/nifi@sha256%3A78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
                      "product_identification_helper": {
                        "purl": "pkg:oci/nifi@sha256:78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech/sdp/nifi"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "nifi"
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "3.1.3-stackable26.3.0-arm64",
                    "product": {
                      "name": "hive:3.1.3-stackable26.3.0-arm64",
                      "product_id": "pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
                      "product_identification_helper": {
                        "purl": "pkg:oci/hive@sha256:970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech/sdp/hive"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.1.3-stackable26.7.0-arm64",
                    "product": {
                      "name": "hive:3.1.3-stackable26.7.0-arm64",
                      "product_id": "pkg:oci/hive@sha256%3A0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
                      "product_identification_helper": {
                        "purl": "pkg:oci/hive@sha256:0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech/sdp/hive"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "hive"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "2.6.0-stackable26.3.0-arm64",
                    "product": {
                      "name": "nifi:2.6.0-stackable26.3.0-arm64",
                      "product_id": "pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
                      "product_identification_helper": {
                        "purl": "pkg:oci/nifi@sha256:ce993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "2.6.0-stackable26.7.0-arm64",
                    "product": {
                      "name": "nifi:2.6.0-stackable26.7.0-arm64",
                      "product_id": "pkg:oci/nifi@sha256%3A1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
                      "product_identification_helper": {
                        "purl": "pkg:oci/nifi@sha256:1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech/sdp/nifi"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "nifi"
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Stackable"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.4.13",
                "product": {
                  "name": "zookeeper:3.4.13",
                  "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar",
                  "product_identification_helper": {
                    "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "3.4.6",
                "product": {
                  "name": "zookeeper:3.4.6",
                  "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar",
                  "product_identification_helper": {
                    "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "zookeeper"
          }
        ],
        "category": "vendor",
        "name": "org.apache.zookeeper"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar",
        "relates_to_product_reference": "pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar",
        "relates_to_product_reference": "pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar",
        "relates_to_product_reference": "pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar",
        "relates_to_product_reference": "pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar",
        "relates_to_product_reference": "pkg:oci/hive@sha256%3A1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar",
        "relates_to_product_reference": "pkg:oci/nifi@sha256%3A78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar",
        "relates_to_product_reference": "pkg:oci/hive@sha256%3A0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
          "product_id": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
        },
        "product_reference": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar",
        "relates_to_product_reference": "pkg:oci/nifi@sha256%3A1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-0201",
      "flags": [
        {
          "label": "vulnerable_code_not_in_execute_path",
          "product_ids": [
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
          "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Security Advisory",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0201"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "The flaw and its fix are entirely server side. ZOOKEEPER-1392 changed the OpCode.getACL branch of FinalRequestProcessor so that the caller is checked against READ|ADMIN before the GetACLResponse is built and digest scheme IDs are masked otherwise. Exploiting it means sending a getACL request to a running, vulnerable ZooKeeper server whose znodes carry digest ACLs. Nothing in the client library is involved.\n\nThe hive image ships the standalone Hive Metastore and nothing else. The zookeeper 3.4.13 jar is a transitive dependency of hadoop-common and hadoop-auth 3.1.4 by way of Curator 2.13.0, and only its client classes are ever used, for ZooKeeper based service discovery and the delegation token store. The metastore process never starts a ZooKeeper server, so org.apache.zookeeper.server.FinalRequestProcessor is dead code in this image. ZooKeeper ensembles on the platform are deployed from the separate zookeeper image, which runs 3.9.x and contains the fix.",
          "product_ids": [
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A127cfc9a2477d65e8ef484a688f9dbfdac1304e450e5f83e7b99f75e3dc147a2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A970c656bbf69fb2ec5cdd082dd6ea8b55f6cc3292d069fc10e24bac95d3135ea?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A1a681626ebe95cb095caf589562cbbbce4e53f078bfdd8eaf98f510af92feaca?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fhive",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.13?type=jar@pkg:oci/hive@sha256%3A0e664e85eca084cd8fc3cc82c2e9e1f3c58f5bd8032a372cd123e9ca739199c3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fhive"
          ]
        },
        {
          "category": "impact",
          "details": "The flaw and its fix are entirely server side. ZOOKEEPER-1392 changed the OpCode.getACL branch of FinalRequestProcessor so that the caller is checked against READ|ADMIN before the GetACLResponse is built and digest scheme IDs are masked otherwise. Exploiting it means sending a getACL request to a running, vulnerable ZooKeeper server whose znodes carry digest ACLs. The client library is not involved.\n\nIn the nifi image the zookeeper 3.4.6 jar sits inside nifi-iceberg-processors-nar, where it is a transitive dependency of hive-exec and hive-metastore 3.1.3. NiFi loads each NAR in its own class loader, so this jar is reachable only from the Iceberg processors and only as a Hive Metastore client. NiFi's own clustering, leader election, state provider and the optional embedded ZooKeeper server come from nifi-framework-zookeeper-bundle, which is built against ZooKeeper 3.9.4. No code path in this image starts a ZooKeeper server from the 3.4.6 jar. ZooKeeper ensembles on the platform are deployed from the separate zookeeper image, which runs 3.9.x and contains the fix.",
          "product_ids": [
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A6c3ff83ff818e3147a4e3215b296b896f28186d54a3c6eb6cddda4fe788d5c21?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3Ace993fec00718e182c3db95deb5b253d48eeb1479fbca95ac987b16d9b105684?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A78a80f27d24721275f6b63841711820878aac84bc070f13cc7b3fe9c0f72bec2?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi",
            "pkg:maven/org.apache.zookeeper/zookeeper@3.4.6?type=jar@pkg:oci/nifi@sha256%3A1ba42eae51e8a63af9cc1311cbacf401114ba702512778e3651e2f403edf5b73?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fnifi"
          ]
        }
      ],
      "title": "CVE-2019-0201"
    }
  ]
}