{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:88c2db83-4dbd-5430-8c23-ac75da4edf25", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1", "version": "3.4.10-tuxcare.1", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10", "type": "library", "group": "org.apache.zookeeper", "version": "3.4.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:559d264e-1385-5cdb-8c88-a4bbca409c7f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. The target Apache ZooKeeper 3.4.10 is not affected by CVE-2017-5637. The fix for this vulnerability (ZOOKEEPER-2693) was authored by upstream Apache and shipped in version 3.4.10, which TuxCare onboarded. The fix introduces a whitelist mechanism (zookeeper.4lw.commands.whitelist property) that disables the CPU-intensive \"wchp\" and \"wchc\" four-letter word commands by default, preventing the DoS attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:e15314ce-0382-541a-9a47-1e0844ea6fd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. CVE-2018-8012 affects ZooKeeper versions before 3.4.10 due to lack of authentication when servers join a quorum. The target is version 3.4.10, which includes the upstream fix (ZOOKEEPER-1045, commit 8a06bd1cc) that adds quorum authentication infrastructure. The fix was authored by Apache committers and shipped in the upstream 3.4.10 release before TuxCare onboarded this version. Authentication calls are present at all connection points: Learner.java:246 (learner-side), LearnerHandler.java:168 (leader-side), and QuorumCnxManager.java:333,460 (peer connections). The vulnerable pattern (absence of authentication infrastructure) is not present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a576d2a7-9f0c-5f14-9b77-2f081981f477", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0201 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:8e475753-0f66-5711-8292-74ca9cecb3f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44981 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:612b98c3-2c7e-587d-8b71-658179ad8370", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.4.10 is not affected by CVE-2024-23944. The vulnerability concerns persistent watchers (addWatch command) that allow monitoring child znodes without ACL checks at event delivery time. Version 3.4.10 does not contain the persistent watcher feature, which was introduced in ZooKeeper 3.6.0. The target only has regular (one-time) watchers that require ACL checks at registration t...", "justification": "code_not_present" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:4a61058b-c4ed-5e3a-884f-45a415afd5c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found, and this version is past the fix on its own release line. Version 3.4.10 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:6771ce90-06da-5486-b746-de54dc7ae12d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.4.10 is not affected by CVE-2025-58457. The vulnerability targets the AdminServer feature's `Commands.handleAuthorization` method, which checks ACL permissions for snapshot/restore admin commands. This entire feature (AdminServer, Commands class, snapshot/restore admin endpoints) does not exist in version 3.4.10\u2014it was introduced in later ZooKeeper releases (3.5+). The attack surfac...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:b1169012-bafe-5b3f-b121-f7069444de8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a14d37f5-d93c-5426-b329-d9114525dd7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:44e71243-8f30-595c-8136-b3d623055a57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:bf24abfc-5c3a-5740-a35c-2a1a6001cdac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-100302 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target is ZooKeeper 3.4.10 (HEAD b6db5e6be). It has no multiRead operation. The ZOOKEEPER-3402 multiRead feature, the component the CVE affects (3.7.0-3.9.6), is absent from this version. Its multi opcode handles only write ops (check/create/delete/setData), and each result is small. A small request therefore cannot be amplified into a large in-memory response.", "justification": "code_not_present" } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:a3bbce2a-20c3-51df-a964-985e8d2847a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:c52e1c68-9144-51be-8f19-bf7daae83748", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:20179580-d69e-5a12-8456-a3577ef6dd84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:2b420b43-44e1-52a2-916f-0bfea3c7a73c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:6c87949a-0a6a-5b43-9d0e-a7290f99911e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.4.10 is not affected by CVE-2026-59969. The vulnerability concerns quorum TLS hostname verification in FIPS mode, a feature that does not exist in version 3.4.10. This version uses plain TCP sockets for all quorum communication without any TLS support. The SSLContextAndOptions class, X509Util class, and all FIPS-mode infrastructure were introduced in later versions (3.5.x+). The fix...", "justification": "code_not_present" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:f48e4607-4359-5cdc-a736-a2d9820687e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-79993 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.4.10 is not affected by CVE-2026-79993. The vulnerability concerns the deleteContainer opcode (OpCode 20), which bypasses ACL authorization checks in versions 3.8.0-3.8.6 and 3.9.0-3.9.5. However, version 3.4.10 predates the introduction of container nodes and the deleteContainer opcode entirely. Analysis confirms: (1) OpCode.deleteContainer (value 20) is not defined in the OpCode i...", "justification": "code_not_present" } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:18acd1f7-0a1f-55ec-bf8f-d62894a99219", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84439 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.4.10 is not affected by CVE-2026-84439. The vulnerability requires the structured audit logging feature (zookeeper.audit.enable=true), which does not exist in version 3.4.10. Audit logging was introduced in ZOOKEEPER-1260 (November 2019) and first appeared in release 3.6.0, approximately 2 years after 3.4.10 was released. The vulnerable code (AuditEvent.java, audit package, t...", "justification": "code_not_present" } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ], "bom-ref": "urn:uuid:b0cef45f-908a-5a19-9616-86a56522c227", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84501 does not affect version 3.4.10-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper version 3.4.10 is NOT AFFECTED by CVE-2026-84501. The vulnerable component (EnsembleAuthenticationProvider) does not exist in this version. It was introduced in commit dc9097247 (February 2019, ZOOKEEPER-3239) as part of version 3.8.0+, which is significantly later than the 3.4.10 release. The ensemble authentication mechanism that enables the log injection vulnerability is not...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.4.10-tuxcare.1" } ] }