CVE-2017-5637

zookeeper: Incorrect input validation with wchp/wchc four letter words

Published Oct 10, 2017 CVSS 3.0 · 7.5 High EPSS 73.1% KEV · Not listed
Description
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-986-1 zookeeper security update
Debian DSA Debian DSA DSA-3871-1 zookeeper security update
Github GHSA Github GHSA GHSA-7cwj-j333-x7f7 Uncontrolled Resource Consumption in Apache ZooKeeper
Ubuntu USN Ubuntu USN USN-4789-1 Apache ZooKeeper vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
apache
Published
Updated
Sep 17, 2024, 12:16 AM
Reserved
Jan 29, 2017, 12:00 AM
Status
Modified
Published
Oct 10, 2017, 1:30 AM
Modified
Jun 17, 2026, 1:20 AM
Severity
Moderate
Public date
Feb 7, 2017, 12:00 AM