https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Bug ID: 1454808
Summary: CVE-2017-5637 zookeeper: Incorrect input validation
with wchp/wchc four letter words
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, chazlett(a)redhat.com,
ctubbsii(a)fedoraproject.org, ethan(a)ethantuttle.com,
etirelli(a)redhat.com, felias(a)redhat.com,
hchiorea(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
kseifried(a)redhat.com, kverlaen(a)redhat.com,
lpetrovi(a)redhat.com, mbaluch(a)redhat.com,
mluscon(a)gmail.com, mwinkler(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
rrajasek(a)redhat.com, rzhang(a)redhat.com, s(a)shk.io,
tiwillia(a)redhat.com, tkirby(a)redhat.com,
tstclair(a)heptio.com, vhalbert(a)redhat.com
Two four letter word commands “wchp/wchc” are CPU intensive and could cause
spike of CPU utilization on ZooKeeper server if abused, which leads to the
server unable to serve legitimate client requests.
Upstream issue:
https://issues.apache.org/jira/browse/ZOOKEEPER-2693
References:
https://vulners.com/exploitdb/EDB-ID:41277
--
You are receiving this mail because:
You are on the CC list for the bug.