{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f26807a0-e9ef-587a-bd86-38ad5caeac47", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2", "version": "3.7.1-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1", "type": "library", "group": "org.apache.zookeeper", "version": "3.7.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:ac2ca08d-5a38-5e41-8d15-b1f61d3d07de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-5637 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:42cf4f78-52f0-5079-850a-bb30153d3a21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-8012 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:698d8073-5276-5fd4-b1a0-cf2c16ea9b1a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Not affected. The upstream ZOOKEEPER-1392 fix (commits 5ff19e367, 17c6b264f, af741cb31) is already in this 3.7.1 tree. FinalRequestProcessor's getACL handler requires READ or ADMIN permission, and masks the digest hash for callers without ADMIN. The fix is upstream-authored and was already in the upstream release that TuxCare onboarded.", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:f62bc515-f4f4-578f-a8ab-c60801494ecb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44981 is fixed in version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:330f48dc-eaa5-5cb1-8cff-042dc79f39e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23944 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:cdc343ec-1d0e-531e-a035-dad1e4fed2f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51504 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:c891eba8-1a4e-540a-beea-9b44efcabc20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58457 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:50793a73-6bf2-5292-8e95-652f381aa0d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:d2a11721-854c-58f7-a076-9b497cee42b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:fa3c946e-ab5c-587f-8fde-2c80dc590895", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:67be8ed7-168e-5fcb-8c1e-76ffa9fea705", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100302 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:6bd46529-fd1e-5651-87ae-202efd714cad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:a3281c99-00b6-5159-96cc-762842bdfea9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:848724e4-019b-5f79-a489-0e13bd170bcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:bb5cc671-2c6f-5d97-9966-13f08569bffd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:734eedaf-34b0-56c7-baf6-294ac600e194", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59969 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:ad1a4834-8a12-51e9-b1fb-432f6ff43ac6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:5a376aa7-ec54-553a-afb5-d05b04eb6a06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84439 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ], "bom-ref": "urn:uuid:58c99f62-a045-5442-93e0-538dc5411dd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84501 affects version 3.7.1-tuxcare.2 of org.apache.zookeeper:zookeeper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.1-tuxcare.2" } ] }