{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3f60b885-f171-5cf9-a113-c3abe8d752f9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2", "type": "library", "group": "org.apache.zookeeper", "bom-ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2", "version": "3.8.3-tuxcare.2", "pedigree": { "ancestors": [ { "name": "zookeeper", "purl": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3", "type": "library", "group": "org.apache.zookeeper", "version": "3.8.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-5637", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:2b08441b-7102-57e1-810b-2e9b08ccd45d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5637 does not affect version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper. The target repository (Apache ZooKeeper 3.8.3-tuxcare.2) is NOT affected by CVE-2017-5637. The vulnerability concerning CPU-intensive four-letter word commands \"wchp\" and \"wchc\" was fixed in the upstream Apache ZooKeeper release before TuxCare onboarded version 3.8.3. The fix implements a whitelist mechanism (via zookeeper.4lw.commands.whitelist property) that blocks these commands by default, preventing the CPU exhaustion DoS attack described in the CVE. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.10; >= 3.5.0, < 3.5.3), NVD (= 3.4.0; = 3.4.1; = 3.4.2; = 3.4.3; = 3.4.4; = 3.4.5; = 3.4.6; = 3.4.7; = 3.4.8; = 3.4.9; = 3.5.0; = 3.5.1; = 3.5.2), cve.org (>= 3.4.0, <= 3.4.9; >= 3.5.0, <= 3.5.2), Snyk (>= 3.4.6, < 3.4.10; >= 3.5.0-alpha, < 3.5.3-beta).", "justification": "code_not_present" } }, { "id": "CVE-2018-8012", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:4bdc7edf-49e9-5e64-9353-42112c3f537b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8012 does not affect version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper. CVE-2018-8012 describes a vulnerability where no authentication/authorization mechanism existed for servers joining a ZooKeeper quorum. The fix (ZOOKEEPER-1045, ported in commit 75411ab34) adds a complete SASL-based authentication framework with QuorumAuth classes and authentication enforcement at connection points. This fix was already present in upstream Apache ZooKeeper 3.8.3 when TuxCare onboarded the version. The authentication capability exists in the codebase but requires configuration (quorum.auth.enableSasl) to enable. The target version 3.8.3-tuxcare.2 contains the defense code; it is not vulnerable to the original CVE which described the complete absence of any authentication mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta), NVD (< 3.4.10; >= 3.5.0, <= 3.5.3; = 3.5.0-alpha; = 3.5.3-beta), cve.org (< 3.4.10; >= 3.5.0-alpha, <= 3.5.3-beta), Snyk (< 3.4.10; >= 3.5.0-alpha, < 3.5.4-beta).", "justification": "requires_configuration" } }, { "id": "CVE-2019-0201", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ae557939-218d-548c-bc09-1e78dfa85d66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0201 does not affect version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 The target Apache ZooKeeper 3.8.3 repository is NOT AFFECTED by CVE-2019-0201. The vulnerability (unauthorized disclosure of digest authentication hashes via getACL()) was fixed in upstream commit af741cb319d4760cfab1cd3b560635adacd8deca (January 2019) by Apache developer Andor Molnar. This fix was already present in the upstream Apache ZooKeeper 3.8.3 release when TuxCare onboarded it in commi...", "justification": "code_not_present" } }, { "id": "CVE-2023-44981", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c59ae4d1-349b-54a5-9f3c-b4227cac2fc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-44981 does not affect version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper. CVE-2023-44981 is NOT present in this version. The vulnerability was an authorization bypass in SASL Quorum Peer authentication where missing instance parts in GSSAPI authentication IDs (e.g., 'user@REALM' instead of 'user/host@REALM') allowed unauthorized endpoints to join the cluster. The fix (ZOOKEEPER-4753, commit 96b3172ca) was already included in Apache ZooKeeper upstream release 3.8.3, which TuxCare then onboarded. The target code contains the complete defense: it validates that GSSAPI authorization IDs have exactly 3 components and explicitly rejects those that don't by setting authzFlag=false.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1), NVD (< 3.7.2; >= 3.8.0, < 3.8.3; = 3.9.0), cve.org (>= 3.9.0, < 3.9.1; >= 3.8.0, <= 3.8.2; >= 3.7.0, <= 3.7.1; < 3.7.0), Snyk (< 3.7.2; >= 3.8.0, < 3.8.3; >= 3.9.0, < 3.9.1).", "justification": "code_not_present" } }, { "id": "CVE-2024-23944", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8b911c77-6372-5d65-80a1-4e97263475fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23944 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2024-51504", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0cfbef83-3218-53c2-8eac-956d14f835be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-51504 does not affect version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test, and the functions the fix changes do not exist in it. Version 3.8.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-g93m-8x6h-g5gv (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2025-58457", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:2f6de3be-c5c8-5bcf-9ff1-144f6048ca24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-58457 does not affect version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper. not_affected \u2014 Version 3.8.3 does not contain the vulnerable code. The snapshot and restore AdminServer commands, along with their authentication/authorization framework (including the flawed permission checking), were introduced in version 3.9.0. This version predates the entire feature set that contains the vulnerability. The CVE correctly identifies affected versions as 3.9.0-3.9.3, where the feature exist...", "justification": "code_not_present" } }, { "id": "CVE-2026-100235", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:de78ed1f-6919-51fc-9462-5090c1d4ae4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100235 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100252", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:95aedaf0-d7ca-5e4f-a892-09f4352210d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100252 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100300", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:88b6551b-bbfa-55e6-bba9-4afecdc1d29a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100300 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-100302", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:d64cc5d9-b21f-5869-bd41-24d78b8a9a41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-100302 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-115448", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:1cbddafa-a663-50ef-9a65-d8b96741f269", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-115448 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24281", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:4c3b3614-0def-502c-a9b2-e82a9d2fb62f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24281 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-24308", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5568486e-d91e-58d8-918d-b4a607d7a2a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-24308 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59739", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:1ac6964a-bae1-5706-ad2b-01dd9b3b93d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59739 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-59969", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8b905766-b423-5ad3-8f1c-648bc18df501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59969 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-79993", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:445c7964-1f4c-53f0-838a-a38366128e97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-79993 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84439", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:6fe29116-4f81-50bf-8826-0a59bd2ed6f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84439 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } }, { "id": "CVE-2026-84501", "affects": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c4f6d428-d925-58c2-ac72-96ae9b0241f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84501 affects version 3.8.3-tuxcare.2 of org.apache.zookeeper:zookeeper." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.3-tuxcare.2" } ] }