{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2fa9d0ca-77d4-51d9-8f03-cb4327fb8360", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4", "version": "3.7.2-tuxcare.4", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2", "type": "library", "group": "org.apache.zookeeper", "version": "3.7.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:059ffd6a-69c9-52ff-b0a1-90446c068928", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper. CVE-2017-5637 affects Apache ZooKeeper versions through 3.4.9 and 3.5.2, causing CPU exhaustion via abuse of wchp/wchc four-letter word commands. The target version 3.7.2 already contains the upstream fix (ZOOKEEPER-2693) that implements a whitelist-based defense mechanism. The fix was authored by Apache upstream (hanm@apache.org) and shipped in the Apache ZooKeeper 3.7.2 release that TuxCare onboarded. By default, only the \"srvr\" command is whitelisted; wchp and wchc are blocked, preventing the CPU exhaustion attack. The vulnerable pattern has been removed by the upstream vendor's fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:ed8c1770-f1f7-557d-b6f8-1eb2a3ffa5f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper. CVE-2018-8012 is NOT present in ZooKeeper 3.7.2-tuxcare.2. The vulnerability (lack of authentication when servers join the quorum) was fixed by upstream Apache ZooKeeper in commit 75411ab34 (ZOOKEEPER-2935, porting ZOOKEEPER-1045), which was already included in the Apache ZooKeeper 3.7.2 release that TuxCare onboarded. The target contains complete SASL-based quorum authentication infrastructure with authentication calls at all critical connection points (learner-to-leader and leader-accepting-learner). The authentication code is present but opt-in by default for backward compatibility, which is the vendor's authoritative fix strategy. The vulnerable pattern (complete absence of authentication capability) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "code_not_present" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:11c968d4-c82d-50d8-9b54-387b5466aaae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target repository (Apache ZooKeeper 3.7.2-tuxcare.2) is NOT AFFECTED. The vulnerability (CVE-2019-0201) was fixed upstream in commit af741cb31 by Apache developer Andor Molnar before TuxCare onboarded version 3.7.2. The fix implements two-layer protection: (1) requires READ or ADMIN permission for getACL requests, and (2) masks digest authentication hashes for users with READ but not ADMIN perm...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:f56691a5-44df-539c-9e17-202f75d4f5ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44981 does not affect version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper. CVE-2023-44981 affects Apache ZooKeeper's SASL quorum authentication when principals lack the instance part (e.g., 'eve@EXAMPLE.COM'). The target repository version 3.7.2-tuxcare.2 is NOT AFFECTED because the upstream Apache ZooKeeper 3.7.2 release already contained the fix (commit d59f8d6c8) authored by Damien Diederen. The fix adds explicit rejection of malformed authorization IDs (lines 151-153) and distinguishes DIGEST-MD5 from GSSAPI authentication (line 147). TuxCare onboarded this already-fixed upstream version, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1), NVD (< 3.7.2; >= 3.8.0, < 3.8.3; = 3.9.0), cve.org (>= 3.9.0, < 3.9.1; >= 3.8.0, <= 3.8.2; >= 3.7.0, <= 3.7.1; < 3.7.0), Snyk (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1).", "justification": "code_not_present" } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:12dfca52-a3f2-59dc-8992-b582c1b44842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23944 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:8da1053a-05fe-5a9a-a0ca-2aca1e94a195", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.7.2 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:28bf3c20-3417-530d-8ac2-5bce65891ba9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper. not_affected \u2014 Target version 3.7.2 is NOT affected by CVE-2025-58457. The vulnerability exists in the AdminServer authentication/authorization framework introduced in ZooKeeper 3.9.0. The target version 3.7.2 predates this feature by multiple major releases and does not contain the vulnerable code. The handleAuthorization method, SnapshotCommand, and RestoreCommand classes that contain the improper permissio...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:c7b3e458-5294-5a6a-9f86-287650133b61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:06f3247f-93a5-54be-8450-1e28ad81cb2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:23870798-15bd-511f-956e-f870bb19391c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:51008543-6c74-5ce1-9552-3b049a069e69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100302 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:ea9937df-5961-50a2-b265-234dce12a628", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:54269179-a4da-5090-a2b5-bf876c169599", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:25696510-5611-5077-b4d9-58b941a98345", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:4d5459ae-f18f-55d2-8697-01142f3dc756", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:7651b945-de81-5f4d-93c9-3d32adc5fdc8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59969 does not affect version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper. not_affected \u2014 CVE-2026-59969 affects Apache ZooKeeper deployments running in FIPS mode, where hostname verification fails due to incompatibility between custom TrustManagers and FIPS security providers. Version 3.7.2 lacks FIPS mode support entirely (added in ZOOKEEPER-4393, June 2023, not present on the 3.7.2 branch). When 3.7.2 is run with a FIPS provider configured at JVM level, it fails to initialize SSL...", "justification": "code_not_present" } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:725b10eb-153e-554d-95ce-cb8c237ea535", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:98e29d4e-7b7d-50a6-83c3-5be82e5f9707", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84439 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ], "bom-ref": "urn:uuid:d9a8d6e2-dec7-515a-b9d7-5a7d766bfd1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84501 affects version 3.7.2-tuxcare.4 of org.apache.zookeeper:zookeeper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.7.2-tuxcare.4" } ] }