CVE-2017-5637
- State
- Published
- Severity
- Not scored
- Published
- Oct 10, 2017
- Updated
- Sep 17, 2024
- Reserved
- Jan 29, 2017
Description
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache ZooKeeperApache Software Foundation |
|
References
- [dev] 20171009 [SECURITY] CVE-2017-5637: DOS attack on wchp/wchc four letter words (4lw)mailing-list
- 98814vdb-entry
- RHSA-2017:3355vendor-advisory
- RHSA-2017:3354vendor-advisory
- RHSA-2017:2477vendor-advisory
- DSA-3871vendor-advisory
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jarmailing-list
- [nifi-commits] 20191113 svn commit: r1869773 - /nifi/site/trunk/security.htmlmailing-list
- [nifi-commits] 20200123 svn commit: r1873083 - /nifi/site/trunk/security.htmlmailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://issues.apache.org/jira/browse/ZOOKEEPER-2693
- https://www.oracle.com//security-alerts/cpujul2021.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.