CVE-2017-5637

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Zookeeper
Vendor
CVE Published:
10 October 2017

Summary

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Affected Version(s)

Apache ZooKeeper 3.4.0 to 3.4.9

Apache ZooKeeper 3.5.0 to 3.5.2

References

https://lists.apache.org/thread.html/58170aeb7a681d462b7f...
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/98814
vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2017:3355
vendor-advisoryx_refsource_REDHAT

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.