https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Bug ID: 1454808 Summary: CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: abhgupta@redhat.com, aileenc@redhat.com, alazarot@redhat.com, chazlett@redhat.com, ctubbsii@fedoraproject.org, ethan@ethantuttle.com, etirelli@redhat.com, felias@redhat.com, hchiorea@redhat.com, java-sig-commits@lists.fedoraproject.org, jcoleman@redhat.com, jolee@redhat.com, kseifried@redhat.com, kverlaen@redhat.com, lpetrovi@redhat.com, mbaluch@redhat.com, mluscon@gmail.com, mwinkler@redhat.com, nwallace@redhat.com, pavelp@redhat.com, rrajasek@redhat.com, rzhang@redhat.com, s@shk.io, tiwillia@redhat.com, tkirby@redhat.com, tstclair@heptio.com, vhalbert@redhat.com
Two four letter word commands “wchp/wchc” are CPU intensive and could cause spike of CPU utilization on ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests.
Upstream issue:
https://issues.apache.org/jira/browse/ZOOKEEPER-2693
References:
https://vulners.com/exploitdb/EDB-ID:41277
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1454809
--- Comment #1 from Andrej Nemec anemec@redhat.com --- Created zookeeper tracking bugs for this issue:
Affects: fedora-all [bug 1454809]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1454809 [Bug 1454809] CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1454810
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0207,reported=20170520,sour |0207,reported=20170520,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:N/I:N/A:H,cwe=CWE-20,fed |/C:N/I:N/A:H,cwe=CWE-20,fed |ora-all/zookeeper=affected, |ora-all/zookeeper=affected, |amq-6/zookeeper=new,bpms-6/ |amq-6/zookeeper=new,bpms-6/ |zookeeper=new,brms-6/zookee |zookeeper=affected,brms-6/z |per=new,jdv-6/zookeeper=new |ookeeper=affected,jdv-6/zoo |,fuse-6/zookeeper=new,opens |keeper=affected,fuse-6/zook |hift-enterprise-2/zookeeper |eeper=new,openshift-enterpr |=new |ise-2/zookeeper=new
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1455642, 1455643
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0207,reported=20170520,sour |0207,reported=20170520,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:N/I:N/A:H,cwe=CWE-20,fed |/C:N/I:N/A:H,cwe=CWE-20,fed |ora-all/zookeeper=affected, |ora-all/zookeeper=affected, |amq-6/zookeeper=new,bpms-6/ |amq-6/zookeeper=new,bpms-6/ |zookeeper=affected,brms-6/z |zookeeper=affected,brms-6/z |ookeeper=affected,jdv-6/zoo |ookeeper=affected,jdv-6/zoo |keeper=affected,fuse-6/zook |keeper=affected,fuse-6/zook |eeper=new,openshift-enterpr |eeper=affected,openshift-en |ise-2/zookeeper=new |terprise-2/zookeeper=new
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0207,reported=20170520,sour |0207,reported=20170520,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:N/I:N/A:H,cwe=CWE-20,fed |/C:N/I:N/A:H,cwe=CWE-20,fed |ora-all/zookeeper=affected, |ora-all/zookeeper=affected, |amq-6/zookeeper=new,bpms-6/ |amq-6/zookeeper=affected,bp |zookeeper=affected,brms-6/z |ms-6/zookeeper=affected,brm |ookeeper=affected,jdv-6/zoo |s-6/zookeeper=affected,jdv- |keeper=affected,fuse-6/zook |6/zookeeper=affected,fuse-6 |eeper=affected,openshift-en |/zookeeper=affected,openshi |terprise-2/zookeeper=new |ft-enterprise-2/zookeeper=n | |ew
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |hghasemb@redhat.com, | |jshepherd@redhat.com Flags| |needinfo?(hghasemb@redhat.c | |om)
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(pavelp@redhat.com | |)
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|security-response-team@redh |pavelp@redhat.com |at.com | Flags|needinfo?(hghasemb@redhat.c | |om) | |needinfo?(pavelp@redhat.com | |) |
--- Comment #5 from Pavel Polischouk pavelp@redhat.com --- taking
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0207,reported=20170520,sour |0207,reported=20170520,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:N/I:N/A:H,cwe=CWE-20,fed |/C:N/I:N/A:H,cwe=CWE-20,fed |ora-all/zookeeper=affected, |ora-all/zookeeper=affected, |amq-6/zookeeper=affected,bp |amq-6/zookeeper=wontfix,bpm |ms-6/zookeeper=affected,brm |s-6/zookeeper=affected,brms |s-6/zookeeper=affected,jdv- |-6/zookeeper=affected,jdv-6 |6/zookeeper=affected,fuse-6 |/zookeeper=affected,fuse-6/ |/zookeeper=affected,openshi |zookeeper=wontfix,openshift |ft-enterprise-2/zookeeper=n |-enterprise-2/zookeeper=new |ew |
--- Comment #6 from Hooman Broujerdi hghasemb@redhat.com --- For fuse the recommended security practice to mitigate this issue is to deploy and operate zookeeper in a secured network where essentially the affected port are protected by the firewall. Additionally it should be assumed that only admin has access to the affected port and this port should not be made available to the world.
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
--- Comment #7 from Christopher Tubbs ctubbsii@fedoraproject.org --- I agree. ZooKeeper isn't designed to be run as a publicly available service. It's designed to be a coordination system for distributed applications deployed within a well-designed cluster architecture.
If the input validation is buggy, that's certainly something to be addressed... but I'm not sure I'd call it a "security" bug, when the real security bug is the user operating it in an environment it wasn't designed for.
That said, ZooKeeper is *very* stable in its API, from what I've seen, and it's generally *very* low risk to upgrade to the latest version to fix any known bugs, provided the dependencies are available.
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Doc Type|If docs needed, set a value |Bug Fix
--- Doc Text *updated* --- A denial of service vulnerability was discovered in ZooKeeper which allows an attacker to dramatically increase CPU utilization by abusing “wchp/wchc” commands, leading to the server being unable to serve legitimate requests.
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEW Assignee|pavelp@redhat.com |security-response-team@redh | |at.com
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1475996
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A denial of service vulnerability was discovered in ZooKeeper which allows an attacker to dramatically increase CPU utilization by abusing "wchp/wchc" commands, leading to the server being unable to serve legitimate requests.
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Data Virtualization
Via RHSA-2017:2477 https://access.redhat.com/errata/RHSA-2017:2477
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1500872
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss BPM Suite
Via RHSA-2017:3355 https://access.redhat.com/errata/RHSA-2017:3355
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
--- Comment #10 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss BRMS
Via RHSA-2017:3354 https://access.redhat.com/errata/RHSA-2017:3354
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0207,reported=20170520,sour |0207,reported=20170519,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:N/I:N/A:H,cwe=CWE-20,fed |/C:N/I:N/A:H,cwe=CWE-20,fed |ora-all/zookeeper=affected, |ora-all/zookeeper=affected, |amq-6/zookeeper=wontfix,bpm |amq-6/zookeeper=wontfix,bpm |s-6/zookeeper=affected,brms |s-6/zookeeper=affected,brms |-6/zookeeper=affected,jdv-6 |-6/zookeeper=affected,jdv-6 |/zookeeper=affected,fuse-6/ |/zookeeper=affected,fuse-6/ |zookeeper=wontfix,openshift |zookeeper=wontfix,openshift |-enterprise-2/zookeeper=new |-enterprise-2/zookeeper=new Last Closed| |2017-11-30 11:58:57
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Viliam Križan vkrizan@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |0207,reported=20170519,sour |0207,reported=20170520,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:N/I:N/A:H,cwe=CWE-20,fed |/C:N/I:N/A:H,cwe=CWE-20,fed |ora-all/zookeeper=affected, |ora-all/zookeeper=affected, |amq-6/zookeeper=wontfix,bpm |amq-6/zookeeper=wontfix,bpm |s-6/zookeeper=affected,brms |s-6/zookeeper=affected,brms |-6/zookeeper=affected,jdv-6 |-6/zookeeper=affected,jdv-6 |/zookeeper=affected,fuse-6/ |/zookeeper=affected,fuse-6/ |zookeeper=wontfix,openshift |zookeeper=wontfix,openshift |-enterprise-2/zookeeper=new |-enterprise-2/zookeeper=new
java-sig-commits@lists.fedoraproject.org