CVE-2017-5637: High severity Apache Zookeeper vulnerability
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Other sources
Two four letter word commands “wchp/wchc” are CPU intensive and could cause spike of CPU utilization on ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests.
Upstream issue:
https://issues.apache.org/jira/browse/ZOOKEEPER-2693
References:
https://vulners.com/exploitdb/EDB-ID:41277
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5637?
CVE-2017-5637 has a high severity level due to its potential to cause significant CPU utilization and impact server availability.
How do I fix CVE-2017-5637?
To fix CVE-2017-5637, upgrade Apache ZooKeeper to version 3.4.10 or later, or 3.5.3 or later.
What systems are affected by CVE-2017-5637?
CVE-2017-5637 affects Apache ZooKeeper versions from 3.4.0 to 3.4.9 and 3.5.0 to 3.5.2.
What are the consequences of exploiting CVE-2017-5637?
Exploiting CVE-2017-5637 can lead to resource exhaustion, making the Apache ZooKeeper server unable to serve legitimate client requests.
Is CVE-2017-5637 related to specific commands in Apache ZooKeeper?
Yes, CVE-2017-5637 involves the misuse of the 'wchp' and 'wchc' commands, which are CPU intensive.