{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6b00cc58-d77d-5143-a71f-d7d678c65993", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2", "version": "3.5.6-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6", "type": "library", "group": "org.apache.zookeeper", "version": "3.5.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:cd7abd70-ed58-5d39-bcb1-758afbd5319b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. Target ZooKeeper 3.5.6 is not affected by CVE-2017-5637. The vulnerability (CPU-intensive wchp/wchc commands causing DoS) was fixed in upstream ZooKeeper 3.5.3 via whitelist-based command filtering. The fix was already present in the upstream 3.5.6 release when TuxCare onboarded it. By default, only 'srvr' command is whitelisted; CPU-intensive commands like wchp/wchc are blocked unless explicitly enabled via zookeeper.4lw.commands.whitelist property.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:9565a27f-2909-50b0-8f9a-2973a5a222c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. CVE-2018-8012 (no quorum authentication) is not present in ZooKeeper 3.5.6. The fix (ZOOKEEPER-1045/ZOOKEEPER-2792) adding quorum peer mutual authentication infrastructure was shipped in the upstream Apache ZooKeeper 3.5.6 release before TuxCare onboarded it. Target version 3.5.6 is in the fixed range per CVE (after 3.5.3-beta). Authentication interfaces and SASL implementations exist at zookeeper-server/src/main/java/org/apache/zookeeper/server/quorum/auth/, with authenticate() calls present at all critical connection points (Learner:291, LearnerHandler:198, QuorumCnxManager:427,548).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2023ec5d-6432-5aad-9657-cb8901cc66f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2019-0201 affects ZooKeeper's getACL() operation which disclosed digest authentication hashes without permission checks. Target version 3.5.6 is NOT vulnerable because the fix (ZOOKEEPER-1392, commit 17c6b264f) was already present in the upstream Apache ZooKeeper 3.5.6 release when TuxCare onboarded it. The fix was authored by Apache committer Andor Molnar (andor@apache.org) on 2019-01-09, ...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:3be3de26-1829-59bb-94a9-860c7fff2f35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44981 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper, and is fixed in 3.5.6-tuxcare.3." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:f0e2fc9c-bc7e-55ea-ab3a-716a55869949", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper version 3.5.6 is not affected by CVE-2024-23944. The vulnerability specifically targets persistent watchers (addWatch command with PERSISTENT/PERSISTENT_RECURSIVE modes), which were introduced in ZooKeeper 3.6.0. Version 3.5.6 predates this feature and does not contain the vulnerable code path. The target repository has no addWatch operation code, no AddWatchMode enum, and no persiste...", "justification": "code_not_present" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:61696a5f-ed55-587e-bf5a-f51f0530384a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.5.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ad11150f-bc97-52d0-8bc1-6811165838da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target version 3.5.6 is not affected by CVE-2025-58457. The vulnerable AdminServer snapshot and restore commands, along with their flawed handleAuthorization method, do not exist in this version. These features were introduced in later versions (3.9.0+) via ZOOKEEPER-4570 and ZOOKEEPER-4571, which are not ancestors of the target commit 40cb3014b. The CVE's affected range (3.9.0-3.9.3) confirms ...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:71b5782a-260a-51c4-a4a1-07332e0da1c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:d308d841-b5e1-5d4e-b90b-eaae311c02d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:69e3385b-61a7-58e7-802d-fd3b857602ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:22152c34-d004-56df-874b-3c0e5d0b7a33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-100302 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target is ZooKeeper 3.5.6-tuxcare.1. The multiRead feature (read sub-operations inside a multi request) was added in 3.7.0 and does not exist here. The multi handler accepts only create, delete, setData and check, so a bundled-read request is rejected and no data-bearing response is built from it. The CVE's affected range starts at 3.7.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:b2a183ad-41ac-5d54-8e32-cded69dedab6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:17ff618b-73cb-5e8c-9232-b131d3574b70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:31c328ad-d19a-54d4-b23c-26b60a524623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:907aa0ce-a903-515a-ae17-deb8b0922d6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7e067829-aa8c-5fa2-a67e-79097e146c43", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2026-59969 is not present in Apache ZooKeeper 3.5.6-tuxcare.1. The vulnerability requires FIPS mode (zookeeper.fips-mode=true), which was introduced AFTER version 3.5.6 via ZOOKEEPER-4393. Version 3.5.6 only supports non-FIPS mode, where hostname verification is provided by ZKTrustManager.performHostVerification() and is enabled by default. The patch adds setEndpointIdentificationAlgorithm(...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:55c88854-4f4f-5a76-aa1d-a0c2d2390f03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2ff46597-aad2-5c53-b6eb-503e13551be6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84439 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.5.6-tuxcare.1 is not affected by CVE-2026-84439. The vulnerability concerns log injection in the audit logging subsystem's tab-separated key=value format (AuditEvent class), which allows attackers to inject forged audit fields via control characters. However, the audit logging feature does not exist in version 3.5.6. Audit logging was introduced in commit 794adf112 (November ...", "justification": "code_not_present" } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ], "bom-ref": "urn:uuid:149ba340-5817-5ff4-a750-9f2dd9eff87c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84501 does not affect version 3.5.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper version 3.5.6-tuxcare.1 is not affected by CVE-2026-84501. The vulnerability exists in the EnsembleAuthenticationProvider class, which logs unsanitized ensemble names containing control characters (newlines, etc.), enabling log injection attacks. However, this authentication provider was not introduced until version 3.8.0 (via ZOOKEEPER-3239 in February 2019). The target versio...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.6-tuxcare.2" } ] }