{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6b7d5030-d1a3-5fda-948b-c9792785e7b3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2", "version": "3.8.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5", "type": "library", "group": "org.apache.zookeeper", "version": "3.8.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:888daab9-a2f4-5957-88fa-dec5d58069fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper. CVE-2017-5637 affects Apache ZooKeeper versions \u22643.4.9 and \u22643.5.2 where CPU-intensive four-letter-word commands (wchp/wchc) could be exploited for denial of service. The target repository at version 3.8.5 is NOT AFFECTED because the upstream fix (commit 5fe68506f by hanm@apache.org) was already present in the 3.8.5 release that TuxCare onboarded. The fix introduces a whitelist mechanism (zookeeper.4lw.commands.whitelist) that restricts four-letter-word command execution. By default, only \"srvr\" is enabled; wchp/wchc must be explicitly whitelisted. Both entry points (NIOServerCnxn:515 and NettyServerCnxn:299) check FourLetterCommands.isEnabled() before executing any command, returning a NopCommand error for non-whitelisted commands. The vulnerable pattern (unrestricted execution of CPU-intensive commands) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:f5379999-82a3-572c-80dd-8c7c4e30b45c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper. Apache ZooKeeper 3.8.5 is not affected by CVE-2018-8012. The quorum peer mutual authentication framework (ZOOKEEPER-1045) was added to ZooKeeper in 2016-2017 via upstream commits, well before the 3.8.5 release. The target repository contains complete authentication infrastructure at HEAD: QuorumAuthServer/QuorumAuthLearner interfaces, SaslQuorumAuthServer/SaslQuorumAuthLearner implementations, and authentication calls in LearnerHandler.java (line 290), Learner.java (line 354), and QuorumCnxManager.java (line 636). Fix commit 75411ab34 (ZOOKEEPER-2935) by afine@apache.org is an ancestor of the TuxCare onboard commit ee6e1818f, confirming the fix shipped in the upstream Apache ZooKeeper 3.8.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:0e7ff9a4-5239-5e77-855f-625049d73480", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.8.5 is not affected by CVE-2019-0201 (unauthorized disclosure of authentication hashes via getACL()). The vulnerability was fixed in upstream commit af741cb319d4760cfab1cd3b560635adacd8deca by Andor Molnar , which shipped in the upstream Apache ZooKeeper 3.8.5 release before TuxCare onboarded this version. The fix adds permission checks (READ or ADMIN requir...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:83edff12-8a7d-5468-ab92-056e96ba3f85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44981 does not affect version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper. The target Apache ZooKeeper 3.8.5 is NOT AFFECTED by CVE-2023-44981. The vulnerability (authorization bypass in SASL Quorum Peer authentication when instance part is missing from auth ID) was fixed by upstream Apache in commit 96b3172ca (ZOOKEEPER-4753), which was already included in the Apache ZooKeeper 3.8.5 release before TuxCare onboarded it. The vulnerable code pattern (missing explicit rejection when authorizationID doesn't have 3 components) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1), NVD (< 3.7.2; >= 3.8.0, < 3.8.3; = 3.9.0), cve.org (>= 3.9.0, < 3.9.1; >= 3.8.0, <= 3.8.2; >= 3.7.0, <= 3.7.1; < 3.7.0), Snyk (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1).", "justification": "code_not_present" } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:08e9ca26-21b7-53a7-842a-c5085ba91152", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.8.5 is NOT affected by CVE-2024-23944. The fix for this persistent watcher ACL bypass vulnerability was already present in the upstream Apache ZooKeeper 3.8.5 release that TuxCare onboarded. The fix (ZOOKEEPER-4799) was authored by Apache upstream developers and adds ACL checks at watch event delivery time to prevent information disclosure of znode paths. The vulnerable code ...", "justification": "code_not_present" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:25264fb1-3f20-5b55-af40-b521621f574e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.8.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:8abe12b9-bdc2-5ff6-b97c-4e8ef1a3e91b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.8.5 does not contain CVE-2025-58457. The vulnerability affects versions 3.9.0-3.9.3 where AdminServer snapshot/restore commands with flawed permission checking were introduced. Version 3.8.5 predates this feature\u2014the snapshot/restore commands (added via ZOOKEEPER-4570/4571 in 3.9.0) and the vulnerable handleAuthorization method do not exist in this version. While 3.8.5's AdminServer...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:e8028d79-a5a1-534a-80c5-b580d384c3fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:54be1ce2-4741-5eeb-9150-5334999813b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:4678e1d2-b709-5e07-b703-685e090d015d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:5e362250-b950-5544-b163-29b40ac925b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100302 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:e87f7f91-7f7a-521c-a5ac-b77d65d9a9a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:087dbed8-1da2-56ab-a669-ba4a7624dc6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:517a3106-d8de-5dbd-9590-880ef94051b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:6cc3c9eb-bb51-52d8-9be8-e87e95840d32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:0426e7da-9527-550b-9e82-4d9497adf860", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59969 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:4bd8dbf8-3720-5d2e-8867-593c2c3475d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:dac932e0-28f8-5faa-84bb-0bcfcc88dcb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84439 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d5df60ed-7b25-57be-8608-2656f428b5fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84501 affects version 3.8.5-tuxcare.2 of org.apache.zookeeper:zookeeper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.5-tuxcare.2" } ] }