{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca0f7dcc-e7e9-5ecf-94dd-7881adf1388d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2", "version": "3.6.0-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0", "type": "library", "group": "org.apache.zookeeper", "version": "3.6.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:bb70979e-a6e5-5c39-a331-e4f7b57632a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper. The target repository (Apache ZooKeeper 3.6.0-tuxcare.1) is not vulnerable to CVE-2017-5637. The fix for the CPU-intensive wchp/wchc four-letter word commands was already present in the upstream 3.6.0 release. The whitelist mechanism (ZOOKEEPER-2693) was implemented by upstream Apache developers (commit 5fe68506f by hanm@apache.org) and is fully functional in the target. By default, only the \"srvr\" command is enabled, while the vulnerable \"wchp\" and \"wchc\" commands are disabled unless explicitly whitelisted via the zookeeper.4lw.commands.whitelist configuration property.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:790c1706-5cc4-504a-957e-ee052992c12e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper. The target Apache ZooKeeper version 3.6.0 is not affected by CVE-2018-8012. The vulnerability affects versions before 3.4.10 and 3.5.0-alpha through 3.5.3-beta. The authentication fix (ZOOKEEPER-1045) was implemented in the upstream Apache ZooKeeper project and shipped in version 3.6.0, which TuxCare then onboarded. The vulnerable pattern (unauthenticated quorum joining) is not present in this version because the upstream vendor's fix is already applied.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:359603e4-5b65-5749-8ce7-2ec140754fac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target repository ZooKeeper 3.6.0-tuxcare.1 is not affected by CVE-2019-0201. The vulnerability (getACL() disclosing authentication hash values without permission checks) was fixed by upstream Apache in commit af741cb31 authored by andor@apache.org. This fix shipped in the upstream 3.6.0 release that TuxCare onboarded. The target code contains complete permission checking (READ|ADMIN required) ...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:cbf03a3c-6d76-5443-85a6-b11d417ceb25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44981 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:3f38ecae-dc72-5f66-bf6d-6791046d6f7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23944 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:960a82ab-2802-56cc-b0f9-ab057227cd0c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.6.0 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:09696b2c-1067-5915-b685-8a287c29e562", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Version 3.6.0 is NOT AFFECTED by CVE-2025-58457. The vulnerability exists in the AdminServer's SnapshotCommand and RestoreCommand classes (introduced in ZOOKEEPER-4570/4571 for versions 3.9.0+), which perform flawed permission checking by evaluating composite permission bitmasks instead of checking each required permission bit individually. Version 3.6.0 predates these features entirely\u2014the Sna...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:09deb90e-dd68-5c6b-aab7-d5d09aa5c3a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:a0700544-f30c-5e33-8469-3cece4ece50f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:70d4be78-ae98-5b0a-92ed-8985d88671c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:746a6da2-201f-51a1-9872-966766c8472d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100302 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:228b2347-dcd1-5bb9-abeb-e449bd04c050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:f70b58b5-ee5b-50f1-9426-f8957b2f08b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:7ec56a44-de1b-52ad-950b-00b2de640daf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:788bfa9d-2adc-51f6-b519-c4038c1093a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:655d41d5-025d-5a54-818d-8f160063ad33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 The target (Apache ZooKeeper 3.6.0) is NOT AFFECTED by CVE-2026-59969. The vulnerability requires FIPS mode to be enabled (zookeeper.fips-mode=true), but FIPS mode support was not introduced until version 3.8.2. In the only mode the target supports (non-FIPS), hostname verification is properly implemented via ZKTrustManager and ZKHostnameVerifier, which are enabled by default for quorum TLS con...", "justification": "code_not_present" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:8246b0f5-8673-580a-901d-b6b533885ecc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5731ebb7-7735-5d22-8137-38303b305dee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84439 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5c4fdd21-d8b1-5261-9929-6e1b2516f616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84501 affects version 3.6.0-tuxcare.2 of org.apache.zookeeper:zookeeper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.6.0-tuxcare.2" } ] }