{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d578b8e4-e0c1-5825-aba3-37491442149a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2", "version": "3.8.6-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6", "type": "library", "group": "org.apache.zookeeper", "version": "3.8.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:f3a5b51d-505b-5417-bdd5-c1a9b024582e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. CVE-2017-5637 is NOT present in target version 3.8.6. The vulnerability (CPU-intensive four-letter-word commands wchp/wchc causing DoS) was fixed by upstream Apache ZooKeeper in commit 5fe68506f (ZOOKEEPER-2693), which introduced a whitelist mechanism for 4lw commands. This fix was already present in upstream release 3.8.6 when TuxCare onboarded it (commit ea4d9d009). The target code contains the complete whitelist defense: FourLetterCommands.isEnabled() checks reject non-whitelisted commands before execution, and wchp/wchc are excluded from the default whitelist (only \"srvr\" enabled by default). Both entry points (NIOServerCnxn.java:515, NettyServerCnxn.java:299) implement the check. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:347dbc00-8520-5491-916d-274dd7955cfb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. The target ZooKeeper 3.8.6 is not affected by CVE-2018-8012. The vulnerability (lack of authentication when servers join a quorum) was fixed by upstream Apache commit 75411ab34 (ZOOKEEPER-2935) which added SASL-based quorum peer authentication infrastructure. This fix was authored by afine@apache.org and shipped in the upstream ZooKeeper 3.8.6 release before TuxCare's onboarding. The authentication code is present in QuorumCnxManager, Learner, and LearnerHandler, blocking unauthenticated servers from joining the quorum when SASL is enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:38f4ba4a-1ac4-5b40-b09d-5293bb505efe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2019-0201 is NOT present in Apache ZooKeeper 3.8.6-tuxcare.1. The vulnerability (unauthorized disclosure of unsalted password hashes via getACL() command without permission checks) was fixed by upstream Apache in commit af741cb319d4760cfab1cd3b560635adacd8deca (ZOOKEEPER-1392, dated 2019-02-06). This fix was already included in the upstream Apache ZooKeeper 3.8.6 release that TuxCare onboar...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ea12e760-07bf-5360-8802-ca3829487ba7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44981 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. The target Apache ZooKeeper 3.8.6-tuxcare.1 is NOT AFFECTED by CVE-2023-44981. The vulnerability (SASL authorization bypass when Kerberos principal lacks host component) was fixed in upstream commit 96b3172ca by Apache committer Damien Diederen (ddiederen@apache.org). This fix was already present in Apache ZooKeeper 3.8.6 when TuxCare onboarded the version. The target code contains the required defense: explicit rejection of GSSAPI principals that don't have the expected 3-component format (service/host@realm) by setting authzFlag=false when components.length != 3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1), NVD (< 3.7.2; >= 3.8.0, < 3.8.3; = 3.9.0), cve.org (>= 3.9.0, < 3.9.1; >= 3.8.0, <= 3.8.2; >= 3.7.0, <= 3.7.1; < 3.7.0), Snyk (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1).", "justification": "code_not_present" } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:dc32c48c-5593-5291-b13e-30d56b981ed3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2024-23944 (information disclosure via missing ACL check in persistent watchers) is NOT present in Apache ZooKeeper 3.8.6. The fix (ZOOKEEPER-4799) was already included in the upstream 3.8.6 release that TuxCare onboarded. The vulnerability allowed attackers to monitor child znode paths without READ permission by attaching persistent watchers to parent znodes. The upstream fix added ACL val...", "justification": "code_not_present" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:11acb8a7-4667-5b43-a950-94664172224e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.8.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:d9d3eca9-2abb-5dcd-b821-037196511b9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Version 3.8.6 is NOT AFFECTED by CVE-2025-58457. The vulnerable code pattern (improper permission checking in AdminServer's handleAuthorization method for snapshot and restore commands) was introduced in version 3.9.0 and does not exist in version 3.8.6. The SnapshotCommand and RestoreCommand classes, along with the flawed authorization infrastructure, were added to ZooKeeper in January 2023 (c...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:537636ce-6763-5d22-bc62-537fcd225e7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7f252fd1-b017-5c58-a65c-7ef62f6494e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c304b16a-ef02-5b1a-afb5-42bf2561b472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:61772b79-08ee-5eac-ac1e-5a95b7a92c8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100302 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:57e1e558-c602-5d4e-b27a-dd1a1198a0cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:fc3ef9c2-60e6-51db-9711-6ab6f9581cef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24281 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. The target Apache ZooKeeper version 3.8.6-tuxcare.1 is NOT AFFECTED by CVE-2026-24281. The vulnerability fix was already present in the upstream Apache ZooKeeper 3.8.6 release that TuxCare onboarded on 2026-10-28. The fix commit (33e5d7251, authored by andor@apache.org on 2026-01-23) introduces configuration controls to disable reverse DNS (PTR) lookups during TLS hostname verification, preventing attackers from exploiting PTR records to bypass certificate validation. The vulnerable pattern (unconditional fallback to reverse DNS when IP SAN validation fails) is not present in the target code. This is consistent with the CVE advisory which lists version 3.8.6 as a fixed version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.8.0, < 3.8.6; >= 3.9.0, < 3.9.5), NVD (>= 3.8.0, < 3.8.6; >= 3.9.0, < 3.9.5), cve.org (>= 3.9.0, <= 3.9.4; >= 3.8.0, <= 3.8.5), Snyk (>= 3.8.0, < 3.8.6; >= 3.9.0, < 3.9.5).", "justification": "code_not_present" } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:cbfbf469-d8e2-52d6-8db4-9e9b0af9f9a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-24308 does not affect version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper. Target version 3.8.6-tuxcare.1 is not affected by CVE-2026-24308. The vulnerability (cleartext password logging) was fixed in upstream Apache ZooKeeper 3.8.6 before TuxCare onboarded this version. The fix includes a logRedactor() method that replaces password values with \"***\" before logging at INFO or DEBUG levels. Fix commit 06996fe21 by upstream author andor@cloudera.com was already present in the upstream 3.8.6 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.9.0, < 3.9.5; >= 3.8.0, < 3.8.6), NVD (>= 3.8.0, < 3.8.6; >= 3.9.0, < 3.9.5), cve.org (>= 3.9.0, <= 3.9.4; >= 3.8.0, <= 3.8.5), Snyk (>= 3.5.2-alpha, < 3.8.6; >= 3.9.0, < 3.9.5).", "justification": "code_not_present" } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:57eaa367-15ac-58a5-9189-9552a8ba8dd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:1afe6291-1b6d-5892-975b-e2fc06ccf1a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59969 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:d8ae0359-a877-518f-8337-6d9c7185ac50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:15d95038-8ef3-5453-b085-4ea91385ab2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84439 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ], "bom-ref": "urn:uuid:63076199-88c1-5213-a787-d95abe346f4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84501 affects version 3.8.6-tuxcare.2 of org.apache.zookeeper:zookeeper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.6-tuxcare.2" } ] }