{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:29ca4b2f-0e8c-5d52-a59b-364a6df137b9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1", "version": "3.9.1-tuxcare.1", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1", "type": "library", "group": "org.apache.zookeeper", "version": "3.9.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:652deae9-6eae-573d-b04e-021bb76496bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper. CVE-2017-5637 affects ZooKeeper versions through 3.4.9 and 3.5.2 via CPU-intensive four-letter-word commands (wchp/wchc) causing DoS. The target (ZooKeeper 3.9.1) is NOT affected because the upstream fix (ZOOKEEPER-2693) was already present in the 3.9.1 release. The fix introduces a whitelist mechanism (4lw.commands.whitelist) that disables wchp/wchc by default, blocking the attack before command execution. The defense is present in both NIOServerCnxn.java:518-527 and NettyServerCnxn.java:285-294, with FourLetterCommands.isEnabled() enforcing the whitelist. By default, only \"srvr\" is enabled, preventing the CPU exhaustion attack. This is an upstream fix by Apache committer Michael Han, shipped in the release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:18ba8cc9-08da-517c-9aa8-5a033deb72fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper. CVE-2018-8012 affects Apache ZooKeeper before 3.4.10 and 3.5.0-alpha through 3.5.3-beta due to lack of authentication when servers join the quorum. Version 3.9.1 is not affected because the authentication framework (ZOOKEEPER-1045) was added by upstream Apache and shipped in the 3.9.1 release. The fix includes QuorumAuthServer/QuorumAuthLearner interfaces with SASL implementations, and authentication calls are present at all quorum connection points (QuorumCnxManager, LearnerHandler, Learner). The vulnerable pattern (complete absence of authentication mechanism) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:b4edf0bb-134d-5bc6-9e20-6ba4e0f7f5d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2019-0201 is NOT present in Apache ZooKeeper 3.9.1. The vulnerability involved getACL() disclosing unsalted password hashes from digest authentication ACLs to unauthenticated/unprivileged users. The fix (commit af741cb319d by upstream author andor@apache.org, dated 2019-01-09) was already shipped in upstream release 3.6.0 and is present in the target's 3.9.1 codebase. The target code at Fin...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:09126c5b-852b-574a-86c0-4f903d3edfea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44981 does not affect version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper. Target Apache ZooKeeper 3.9.1-tuxcare.1 is NOT AFFECTED by CVE-2023-44981. The security fix that prevents authorization bypass via malformed SASL principals (missing hostname component) was already present in the upstream Apache ZooKeeper 3.9.1 release when TuxCare onboarded it. The fix (commit 3b01adcc5 by Apache committer ddiederen@apache.org) adds explicit rejection of GSSAPI authentication IDs that lack the required service/host/realm structure, preventing arbitrary endpoints from joining the quorum with the 'eve@EXAMPLE.COM' attack pattern described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1), NVD (< 3.7.2; >= 3.8.0, < 3.8.3; = 3.9.0), cve.org (>= 3.9.0, < 3.9.1; >= 3.8.0, <= 3.8.2; >= 3.7.0, <= 3.7.1; < 3.7.0), Snyk (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1).", "justification": "code_not_present" } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:9f5b918f-8450-54ab-baed-fa622594ad80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23944 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:2a01a17e-8b0e-54c5-8457-946852d6491e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-51504 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:ad7cde7f-840f-507f-9157-00d0b6d080fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58457 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:a8192ef7-ce09-5723-a2c6-bce972150531", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:c5fb8fd0-ec89-54b0-a4a7-0512b7eeb4d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:43e77ab3-94c3-54bc-b30c-084bcd0a6ed6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:5e2e6656-53c5-5d5c-b27d-fb34460c8f3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100302 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:1ef20373-b6f0-543b-86b7-75ce1270108f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:a552289e-65d4-5a37-bbb4-91c59904f029", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:55a1f018-74a3-58dc-8177-3bb41ba7f3ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:dc730954-40ce-5783-8a51-47f37d179ea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:e811ac1c-fca5-5cc6-b6a4-d4c3282577bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59969 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:975d7581-e243-557d-a1aa-bf56aefcbc30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:be5bf1c1-3d0a-5163-a534-25163aff41b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84439 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ], "bom-ref": "urn:uuid:64a23930-21e9-558b-b6c8-6a1c71496b05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84501 affects version 3.9.1-tuxcare.1 of org.apache.zookeeper:zookeeper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.9.1-tuxcare.1" } ] }