Uncontrolled Resource Consumption in Apache ZooKeeper

2022-05-1301:08:23

Google

osv.dev

0.045 Low

EPSS

Percentile

92.5%

JSON

Two four letter word commands “wchp/wchc” are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

CPENameOperatorVersion
org.apache.zookeeper:zookeepereq3.4.8
org.apache.zookeeper:zookeepereq3.4.7
org.apache.zookeeper:zookeepereq3.4.0
org.apache.zookeeper:zookeepereq3.5.2-alpha
org.apache.zookeeper:zookeepereq3.5.1-alpha
org.apache.zookeeper:zookeepereq3.5.3-beta
org.apache.zookeeper:zookeepereq3.4.1
org.apache.zookeeper:zookeepereq3.4.5
org.apache.zookeeper:zookeepereq3.4.6
org.apache.zookeeper:zookeepereq3.4.9

Name	Operator	Version
org.apache.zookeeper:zookeeper	eq	3.4.8
org.apache.zookeeper:zookeeper	eq	3.4.7
org.apache.zookeeper:zookeeper	eq	3.4.0
org.apache.zookeeper:zookeeper	eq	3.5.2-alpha
org.apache.zookeeper:zookeeper	eq	3.5.1-alpha
org.apache.zookeeper:zookeeper	eq	3.5.3-beta
org.apache.zookeeper:zookeeper	eq	3.4.1
org.apache.zookeeper:zookeeper	eq	3.4.5
org.apache.zookeeper:zookeeper	eq	3.4.6
org.apache.zookeeper:zookeeper	eq	3.4.9