{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2734d476-163e-5811-a585-5f3c2d681865", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1", "version": "3.5.9-tuxcare.1", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9", "type": "library", "group": "org.apache.zookeeper", "version": "3.5.9" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:824a56ee-9621-524a-8c1e-eb186e55718f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. The target Apache ZooKeeper version 3.5.9-tuxcare.1 is NOT affected by CVE-2017-5637. The vulnerability (CPU-intensive DoS via wchp/wchc four-letter-word commands) was fixed by Apache in version 3.5.3 (March 2017). The fix introduces a whitelist mechanism that disables potentially abusive commands by default. Since the target is version 3.5.9 (released October 2020), it already contains the upstream vendor's fix. No TuxCare-specific backport was required as the fix was already present in the onboarded upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:17bc234c-2333-5543-ab79-30cbc2635936", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. CVE-2018-8012 is NOT present in ZooKeeper 3.5.9. The vulnerability affected versions before 3.4.10 and 3.5.0-alpha through 3.5.3-beta. The upstream vendor fixed this by implementing ZOOKEEPER-1045, which added SASL-based quorum peer mutual authentication infrastructure. This fix was included in the upstream 3.5.9 release that TuxCare onboarded. The authentication infrastructure is present in the target codebase, including QuorumAuth, SaslQuorumAuthServer, SaslQuorumAuthLearner classes, and authentication calls in QuorumCnxManager (line 601), Learner (line 291), and LearnerHandler (line 198). The vulnerable pattern\u2014complete absence of authentication capability for quorum peer connections\u2014is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:23d76aec-c867-5972-b628-ab07a8fbf5b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2019-0201 affects Apache ZooKeeper's getACL() command, which exposed unsalted digest authentication hashes without permission checking. The target Apache ZooKeeper 3.5.9-tuxcare.1 is NOT AFFECTED because the upstream Apache project already fixed this vulnerability in release 3.5.9 before TuxCare onboarded it. The fix (commit 17c6b264f by andor@apache.org, January 2019) adds two-tier permiss...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:5db76f14-3e94-55b7-bcaf-2783f208c81f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44981 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:de3ef8ab-253c-51f0-9d2c-1077607b474a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.5.9 is NOT AFFECTED by CVE-2024-23944. The vulnerability requires persistent watchers (addWatch command with PERSISTENT_RECURSIVE mode) to expose child znode paths without ACL checks. Persistent watchers were introduced in ZooKeeper 3.6.0 (ZOOKEEPER-1416) and do not exist in 3.5.9. Regular watchers in 3.5.9 cannot achieve the same information disclosure because they only expose the ...", "justification": "code_not_present" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:b3014e2e-5917-5a53-b16f-4441c900b80d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.5.9 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:b0e37f92-762c-5d97-b2ab-4dad910aecf3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.5.9 is not affected by CVE-2025-58457. The vulnerable code (SnapshotCommand, RestoreCommand, and the handleAuthorization method with flawed permission checking) was introduced in version 3.9.0. Version 3.5.9 does not have AdminServer authentication/authorization functionality at all - commands are executed without any permission checks. While this means 3.5.9 has no authorization (w...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:e118cd73-f47f-5a74-9dd0-32d16c8bb684", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:e8b5540b-3f4b-57a1-843b-ae9e40e78a5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:0affb04e-bc6a-5c72-a1a7-85fb27ae59b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:edf3a507-dac6-52d0-9f49-62afe7d6e3e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-100302 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target is Apache ZooKeeper 3.5.9 (tuxcare.1). The multiRead request type, which was added in a later release line (the CVE lists 3.7.0 through 3.9.6), does not exist here. multi only accepts create/delete/setData/check sub-operations, whose results are small and fixed-size. The Brief's input (a bundled read request that materializes large znode data many times) is not received anywhere in the t...", "justification": "code_not_present" } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:12244409-556a-5d34-b939-a262db6464e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:1e785db2-1bf6-5d11-a431-43c228a8c90d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:ff9516f3-bcfe-5d47-8b60-c078e79dc43e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24308 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks the INFO-level configuration dump that exposes sensitive values. Configuration loading logs only the pathname at zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java:209. Raw values are logged only when DEBUG is enabled and an existing non-null value is replaced with a different value at zookeeper-server/src/main/java/org/apache/zookeeper/common/ZKConfig.java:193; shipped logging defaults to INFO at conf/log4j.properties:20.", "justification": "code_not_present" } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:3cb92676-516f-582c-b02d-83530c8128d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:ec2dcbe1-a8eb-5934-9153-aef81c7ff8d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target version 3.5.9 predates FIPS mode support (introduced in 3.8.2) and is not affected by CVE-2026-59969. The vulnerability is specific to FIPS-mode deployments where hostname verification fails despite configuration flags being enabled. Version 3.5.9 uses ZKTrustManager for hostname verification in non-FIPS mode, which correctly enforces hostname matching when configured. The vulnerable cod...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:460fdd35-30c8-5cae-a10e-21cbb5c15674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:8a05adcc-e5a5-53c6-8262-a4a7cb4e7eee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84439 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target version 3.5.9 does not contain the audit logging feature that is vulnerable to log injection. The audit logging subsystem (org.apache.zookeeper.audit package) was introduced in ZooKeeper 3.6.0 (commit 794adf112, November 2019), which is newer than the target version. Without the audit logging feature, the tab-separated audit log format and associated injection vulnerability cannot exist....", "justification": "code_not_present" } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ], "bom-ref": "urn:uuid:95af9043-b7ce-5e4a-8a88-1ce67b922bf2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84501 does not affect version 3.5.9-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target version 3.5.9 is not affected by CVE-2026-84501. The vulnerable EnsembleAuthenticationProvider class was introduced in version 3.6.0 (commit dc9097247, ZOOKEEPER-3239) and does not exist in this earlier version. The \"ensemble\" authentication scheme that would handle add_auth(\"ensemble\", ...) requests is not registered in ProviderRegistry, so the attack vector described in the CVE cannot ...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.9-tuxcare.1" } ] }