{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:84e612ad-4e3c-59d2-b91a-70740ba28be2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2", "version": "3.5.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5", "type": "library", "group": "org.apache.zookeeper", "version": "3.5.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:4ee652ee-ef6e-5a87-8107-f8431931bccb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. CVE-2017-5637 is NOT present in Apache ZooKeeper 3.5.5-tuxcare.2. The vulnerability, which allowed CPU exhaustion via abuse of wchp/wchc four-letter word commands, was fixed in upstream version 3.5.3 (March 2017). The target version 3.5.5 (released May 2019) already contains the complete fix: a whitelist-based defense mechanism that blocks execution of non-whitelisted commands. The fix was shipped in the upstream release that TuxCare onboarded, not applied as a separate backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:4b7afc79-ff52-5b54-8b4f-bc80a527a6fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. Apache ZooKeeper 3.5.5 contains the authentication framework that addresses CVE-2018-8012. The fix was introduced by upstream Apache developers (commit 5a29daedeb5ac7e9e2af87ce1a7bbfad230d5c86 by Michael Han) and was already present in the 3.5.5 release when TuxCare onboarded it. The authentication framework provides SASL-based mutual authentication for quorum peer connections, adding authenticate() calls at all critical connection points (Learner, LearnerHandler, QuorumCnxManager). However, SASL authentication is disabled by default (quorumEnableSasl=false) for backward compatibility, using NullQuorumAuth implementations that perform no authentication. Users must enable SASL via configuration to gain the security benefit. This configurable approach is the vendor's chosen fix strategy.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "requires_configuration" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:3a69c04a-b737-5d25-a1ee-95d3d53416e6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 The target Apache ZooKeeper 3.5.5-tuxcare.2 is NOT vulnerable to CVE-2019-0201. The upstream fix for ZOOKEEPER-1392 (commit 17c6b264f) was already present in the Apache ZooKeeper 3.5.5 release that TuxCare onboarded. The fix implements a two-layer defense in FinalRequestProcessor: (1) requires READ or ADMIN permission to call getACL(), and (2) masks digest authentication hashes by replacing the...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:e989f0cb-8bc7-524a-b623-d9e702018875", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44981 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper, and is fixed in 3.5.5-tuxcare.4." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:bc54c76a-1e5e-5596-861b-aec802010c6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.5.5 is not affected by CVE-2024-23944. This vulnerability is specific to persistent watchers (addWatch command with PERSISTENT/PERSISTENT_RECURSIVE modes), which were introduced in ZooKeeper 3.6.0 on November 8, 2019\u2014seven months after version 3.5.5 was released on April 2, 2019. While the underlying code pattern (watch event delivery without ACL checks in NIOServerCnxn.process() an...", "justification": "code_not_present" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:aa58ec20-e981-5bf0-ac02-c5f632df1773", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.5.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:7df1c72d-bbb6-50ef-88be-e114f2c7e6b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper version 3.5.5 does not contain the vulnerable AdminServer authentication/authorization mechanism. The CVE-2025-58457 vulnerability affects improper permission checking in the handleAuthorization method for snapshot/restore commands, introduced in version 3.9.0. Version 3.5.5 predates this feature entirely: the AdminServer has no authentication system, no handleAuthorization method, an...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:66d9f1d1-9265-5c4b-879d-c007b0914054", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:5af73157-c6db-5785-a377-32f88b06e30c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:9f0992aa-b53d-57ec-ac44-14abed00e5ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:e56c9e09-e44c-5bfd-8170-05e05618f6c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-100302 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target is ZooKeeper 3.5.5 (tuxcare.3). It has no multi-read feature. The multi opcode only accepts write/check sub-operations (create*, delete, setData, check). Any getData/getChildren sub-op is rejected with \"Invalid type of op\". The server therefore never builds the large cumulative in-memory response the CVE describes. The CVE itself lists 3.7.0 through 3.9.6 as affected, and the multiRead f...", "justification": "code_not_present" } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c821958c-adf5-5c5a-9e76-442cd9e3e258", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:3b4b1b8b-7723-538a-ba34-a43cbd74cd7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:34676474-e443-55c8-a19e-bc0a1377fd8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c52dc2e5-2cf9-5c1e-a319-63527be83e62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:ae8f59bb-a648-5eb3-8ee7-98ebc35ab666", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Version 3.5.5 is NOT AFFECTED by CVE-2026-59969. The vulnerability specifically affects FIPS-mode deployments where Java's FIPS security provider bypasses custom TrustManagers, preventing ZKTrustManager from performing hostname verification. Version 3.5.5 does not support FIPS mode at all - it was introduced in version 3.8.x via ZOOKEEPER-4393. In 3.5.5, hostname verification works correctly vi...", "justification": "code_not_present" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:21d4226d-d5bf-5791-95d6-0861bff2f138", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:8fbaaf21-0b5c-5167-ba88-48af922274a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84439 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.5.5 is NOT AFFECTED by CVE-2026-84439. The audit logging feature with tab-separated key=value format (introduced in ZOOKEEPER-1260, commit 794adf112, November 2019) does not exist in version 3.5.5 (released April 2019). The entire audit logging infrastructure (AuditEvent class, audit package, addEntry methods, sanitization logic, zookeeper.audit.enable configuration) is absen...", "justification": "code_not_present" } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ], "bom-ref": "urn:uuid:9d18f217-56eb-5e6c-b315-a7829a36279b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84501 does not affect version 3.5.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper version 3.5.5 is NOT AFFECTED by CVE-2026-84501. The vulnerable component EnsembleAuthenticationProvider does not exist in this version. The feature that introduces the log injection vulnerability was added in version 3.6.0 (commit dc9097247, February 2019), which is after the 3.5.5 release. Since the ensemble authentication scheme handler is absent, the target cannot receive o...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.5-tuxcare.2" } ] }