CVE-2017-5637 Uncontrolled Resource Consumption in Apache ZooKeeper
HighCVSS 7.5
EPSS 73.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.zookeeper/zookeeper(Maven) | >= 3.4.0, <= 3.4.9 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | >= 3.5.0, <= 3.5.2 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | >= 3.4.0, < 3.4.10 | 3.4.10 |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.0 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.1 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.2 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.3 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.4 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.5 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.6 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.7 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.8 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.4.9 | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | >= 3.5.0, < 3.5.3 | 3.5.3 |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.1-alpha | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.2-alpha | No fix listed |
| org.apache.zookeeper/zookeeper(Maven) | = 3.5.3-beta | No fix listed |
| debian/zookeeper(Debian:12) | < 3.4.9-3 | 3.4.9-3 |
| debian/zookeeper(Debian:13) | < 3.4.9-3 | 3.4.9-3 |
| debian/zookeeper(Debian:14) | < 3.4.9-3 | 3.4.9-3 |
| apache zookeeper | = 3.4.0 | No fix listed |
| apache zookeeper | = 3.4.1 | No fix listed |
| apache zookeeper | = 3.4.2 | No fix listed |
| apache zookeeper | = 3.4.3 | No fix listed |
| apache zookeeper | = 3.4.4 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache zookeeper | = 3.4.5 | No fix listed |
| apache zookeeper | = 3.4.6 | No fix listed |
| apache zookeeper | = 3.4.7 | No fix listed |
| apache zookeeper | = 3.4.8 | No fix listed |
| apache zookeeper | = 3.4.9 | No fix listed |
| apache zookeeper | = 3.5.0 | No fix listed |
| apache zookeeper | = 3.5.1 | No fix listed |
| apache zookeeper | = 3.5.2 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Apache ZooKeeper | = 3.4.0 to 3.4.9 | No fix listed |
| Apache ZooKeeper | = 3.5.0 to 3.5.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2017:2477 vendor-advisory
- RHSA-2017:3354 vendor-advisory
- RHSA-2017:3355 vendor-advisory
- issues.apache.org issue-tracking mitigation vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com
- www.oracle.com
- DSA-3871 third-party-advisory vendor-advisory
- 98814 third-party-advisory vdb-entry
- github.com
- Debian Security Tracker CVE-2017-5637 vendor-advisory
- bugs.debian.org issue-tracking
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [dev] 20171009 [SECURITY] CVE-2017-5637: DOS attack on wchp/wchc four letter words (4lw) mailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html mailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html mailing-list