Non notée
CVE-2017-5637 Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper…
Description
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache ZooKeeper | Versions non publiées |
Références
- [dev] 20171009 [SECURITY] CVE-2017-5637: DOS attack on wchp/wchc four letter words (4lw) lists.apache.org
- 98814 www.securityfocus.com
- RHSA-2017:3355 access.redhat.com
- RHSA-2017:3354 access.redhat.com
- RHSA-2017:2477 access.redhat.com
- DSA-3871 www.debian.org
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar lists.apache.org
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.html lists.apache.org
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.html lists.apache.org
- www.oracle.com www.oracle.com
- issues.apache.org issues.apache.org
- www.oracle.com www.oracle.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache ZooKeeper
Les 19 CVE de Apache ZooKeeper →
CVE-2026-100302
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
7.1
Élevée
CVE-2026-115448
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
8.7
Élevée
CVE-2026-100300
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
8.7
Élevée
CVE-2026-100252
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
8.6
Élevée