CVE-2017-5637

Zookeeper 3.5.2 Client - Denial of Service

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

Dos comandos con palabras de cuatro letras "wchp/wchc" provocan un gran consumo de CPU y podrían dar lugar a que se alcance el máximo uso de CPU en el servidor Apache ZooKeeper si se abusa de ellos, lo que da lugar a que el servidor quede deshabilitado para servir a peticiones de clientes legítimos. Las versiones de la 3.4.9 a la 3.5.2 de Apache ZooKeeper tienen este problema, que fue solucionado en las versiones 3.4.10, 3.5.3 y posteriores.

A denial of service vulnerability was discovered in ZooKeeper which allows an attacker to dramatically increase CPU utilization by abusing "wchp/wchc" commands, leading to the server being unable to serve legitimate requests.

Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database. This release of Red Hat JBoss Data Virtualization 6.3 Update 7 serves as a replacement for Red Hat JBoss Data Virtualization 6.3 Update 6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-01-29 CVE Reserved
2017-07-02 First Exploit
2017-08-15 CVE Published
2024-09-17 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation
CWE-306: Missing Authentication for Critical Function
CWE-400: Uncontrolled Resource Consumption

CAPEC

References (15)

URL	Tag	Source
http://www.securityfocus.com/bid/98814	Third Party Advisory
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370%40%3Cdev.zookeeper.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E	Mailing List
https://www.oracle.com//security-alerts/cpujul2021.html	X_refsource_misc
https://www.oracle.com/security-alerts/cpujul2020.html	X_refsource_misc

URL	Date	SRC
https://www.exploit-db.com/exploits/42294	2017-07-02

URL	Date	SRC

URL	Date	SRC
http://www.debian.org/security/2017/dsa-3871	2023-11-07
https://access.redhat.com/errata/RHSA-2017:2477	2023-11-07
https://access.redhat.com/errata/RHSA-2017:3354	2023-11-07
https://access.redhat.com/errata/RHSA-2017:3355	2023-11-07
https://issues.apache.org/jira/browse/ZOOKEEPER-2693	2023-11-07
https://access.redhat.com/security/cve/CVE-2017-5637	2017-11-30
https://bugzilla.redhat.com/show_bug.cgi?id=1454808	2017-11-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.0 Search vendor "Apache" for product "Zookeeper" and version "3.4.0"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.1 Search vendor "Apache" for product "Zookeeper" and version "3.4.1"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.2 Search vendor "Apache" for product "Zookeeper" and version "3.4.2"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.3 Search vendor "Apache" for product "Zookeeper" and version "3.4.3"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.4 Search vendor "Apache" for product "Zookeeper" and version "3.4.4"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.5 Search vendor "Apache" for product "Zookeeper" and version "3.4.5"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.6 Search vendor "Apache" for product "Zookeeper" and version "3.4.6"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.7 Search vendor "Apache" for product "Zookeeper" and version "3.4.7"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.8 Search vendor "Apache" for product "Zookeeper" and version "3.4.8"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.4.9 Search vendor "Apache" for product "Zookeeper" and version "3.4.9"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.5.0 Search vendor "Apache" for product "Zookeeper" and version "3.5.0"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.5.1 Search vendor "Apache" for product "Zookeeper" and version "3.5.1"		-		Affected
Apache Search vendor "Apache"		Zookeeper Search vendor "Apache" for product "Zookeeper"				3.5.2 Search vendor "Apache" for product "Zookeeper" and version "3.5.2"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected