{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:338b7e60-299a-52d2-9962-efb407afb8ea", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2", "version": "3.5.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7", "type": "library", "group": "org.apache.zookeeper", "version": "3.5.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d965d635-afed-5f56-89f1-562ae2039454", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. The target repository (Apache ZooKeeper 3.5.7-tuxcare.1) is not affected by CVE-2017-5637. The vulnerability was fixed in upstream version 3.5.3 by introducing a whitelist-based filtering mechanism for four-letter-word commands. Version 3.5.7 includes the complete fix as part of the upstream release that TuxCare onboarded. The fix commit (6d9fc04c052adbc79bbbb1c63f3f00c816fb8e56) was authored by hanm@apache.org and shipped in the upstream 3.5.7 release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e65b79f1-c248-59bf-8ad3-894db881fcf2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. Apache ZooKeeper 3.5.7-tuxcare.1 is NOT AFFECTED by CVE-2018-8012. The vulnerability (lack of authentication when servers join a quorum) was fixed in upstream Apache ZooKeeper via ZOOKEEPER-1045, which added comprehensive SASL-based authentication infrastructure. This fix was already present in Apache ZooKeeper 3.5.7 when TuxCare onboarded it. The target contains the complete authentication system: QuorumAuth classes, SASL implementations (SaslQuorumAuthServer/Learner), and authentication calls in all critical code paths (QuorumCnxManager line 554, Learner line 291, LearnerHandler line 198). The CVE affects versions before 3.4.10 and 3.5.0-alpha through 3.5.3-beta; version 3.5.7 is beyond this range.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9bc4d827-894f-5e36-a738-eaab1de9da63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2019-0201 affects ZooKeeper versions 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. The target is version 3.5.7, which already contains the upstream fix (ZOOKEEPER-1392) that was committed in January 2019 and included in the 3.5.7 release (February 2020). The fix adds permission checks to getACL() requiring READ or ADMIN permission, and masks digest hashes for users without ADMIN permission...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dd55aab1-a677-59cc-aa37-25c8e203394d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44981 is fixed in version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:bacfa864-e831-56d5-b211-84f66498afee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-23944 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Version 3.5.7 is NOT AFFECTED by CVE-2024-23944. The vulnerability requires the persistent watcher feature (addWatch command) introduced in ZooKeeper 3.6.0, which is absent in 3.5.7. While the underlying watch event delivery mechanism lacks ACL checks in 3.5.7 (same as vulnerable versions), the specific attack vector described in the CVE\u2014continuous monitoring via persistent watchers\u2014cannot be e...", "justification": "code_not_present" } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6c72ade1-da29-50ff-bc5a-5557ca98fba4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.5.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1ff2bb5c-e565-5cf0-aa6a-0b7947d93573", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.5.7 is not affected by CVE-2025-58457. The vulnerability concerns improper permission checks in the AdminServer's snapshot and restore commands, which allow authenticated clients with insufficient privileges to invoke these operations. However, these admin server commands (SnapshotCommand and RestoreCommand) and their associated authorization framework were introduced in ZooKeeper 3...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0041701b-7cf1-5ca8-b420-ba301fc3f72b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8b18f4ee-d00b-5bcf-8cef-6d6d5773795d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:66adc813-4d44-54ce-abd5-ac4e748a6e91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7d097367-54ff-5c70-802d-58a820f898f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-100302 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target is ZooKeeper 3.5.7 (tuxcare.1). The multiRead operation (ZOOKEEPER-3402) was introduced in 3.7.0 and does not exist in this tree. The multi opcode handles only write/check sub-ops, so a batch of reads that builds a large response cannot be sent. The patch's input and goal are not present, so this is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:53e25bc3-01b0-5499-8546-babb857eb6c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:13af08ef-197b-5ca6-a945-0515eb81b8d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b31304b3-cdf4-55ce-af75-e0493ed593e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:11bbc8d0-99f9-5c1f-96c4-0dc6f5618e4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ec06bfc0-1759-54db-a09a-eb78619b2467", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.5.7 is not affected by CVE-2026-59969. This vulnerability specifically affects FIPS-mode deployments where hostname verification fails for quorum TLS connections. Version 3.5.7 does not have FIPS mode support at all, and hostname verification works correctly via ZKTrustManager in the non-FIPS mode that 3.5.7 supports. The fix commits (c0a52c427, 8b4266550) exist in the reposi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4a48c631-23b4-5350-ab54-6ade708294fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c16e786f-27b8-5ff4-8641-05126765ff76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84439 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 ZooKeeper 3.5.7 is not affected by CVE-2026-84439 because the audit logging feature does not exist in this version. The vulnerability requires audit logging to be enabled (zookeeper.audit.enable=true) to inject malicious tab characters into audit log entries. However, the entire audit logging subsystem (AuditEvent, AuditLogger, audit package) was first introduced in ZooKeeper 3.6.0 via ZOOKEEPE...", "justification": "code_not_present" } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cf933f90-2392-5328-b9b0-549656a0be4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-84501 does not affect version 3.5.7-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Apache ZooKeeper 3.5.7-tuxcare.1 is NOT AFFECTED by CVE-2026-84501. The vulnerable component (EnsembleAuthenticationProvider class) does not exist in this version. This class was introduced in version 3.6.0 (February 2019, commit dc9097247) and the log injection vulnerability affects versions 3.8.0+ and 3.9.0+. Version 3.5.7 predates the introduction of this authentication provider entirely. Ex...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.5.7-tuxcare.2" } ] }