GitHub Advisoryadvisory · Maven

GHSA-7cwj-j333-x7f7 Uncontrolled Resource Consumption in Apache ZooKeeper

HIGH Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-5637
Ecosystem
Maven
Packages
org.apache.zookeeper:zookeeper
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2022-07-01

Affected packages

• Maven org.apache.zookeeper:zookeeper: >= 3.4.0, < 3.4.10 → fixed in 3.4.10 • Maven org.apache.zookeeper:zookeeper: >= 3.5.0, < 3.5.3 → fixed in 3.5.3

Description

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Related

Alias · CVE (1)

  • CVE-2017-5637 Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused,… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References