Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-5637

CWE-306 — Missing AuthenticationCWE-400 — Uncontrolled Resource ConsumptionCWE-20 — Improper Input Validation13 documents10 sources
Severity
7.5HIGH
EPSS
17.4%
top 4.93%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Apache Software Foundation Apache ZookeeperApache ZookeeperDebian Debian Linux
Timeline
PublishedOct 10
Latest updateMay 13

Description

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Mavenorg.apache.zookeeper:zookeeper3.4.0 — 3.4.10+1
▶NVDapache/zookeeper13 versions+12
▶CVEListV5apache_software_foundation/apache_zookeeper3.4.0 to 3.4.9, 3.5.0 to 3.5.2+1
▶Debianzookeeper< 3.4.9-3+3
▶Ubuntuzookeeper< 3.4.5+dfsg-1ubuntu0.1~esm1+1

Also affects: Debian Linux 8.0

🔴Vulnerability Details

5
GHSA
Uncontrolled Resource Consumption in Apache ZooKeeper↗2022-05-13
▶
OSV
Uncontrolled Resource Consumption in Apache ZooKeeper↗2022-05-13
▶
OSV
zookeeper vulnerabilities↗2021-03-15
▶
OSV
CVE-2017-5637: Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads↗2017-10-10
▶
CVEList
CVE-2017-5637: Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads↗2017-10-10
▶

💥Exploits & PoCs

1
Exploit-DB
Zookeeper 3.5.2 Client - Denial of Service↗2017-07-02
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Cloud Gateway (Zookeeper) — CVE-2017-5637↗2021-07-15
▶
Ubuntu
Apache ZooKeeper vulnerabilities↗2021-03-15
▶
Red Hat
zookeeper: Incorrect input validation with wchp/wchc four letter words↗2017-02-07
▶
Debian
CVE-2017-5637: zookeeper - Two four letter word commands "wchp/wchc" are CPU intensive and could cause spik...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words [fedora-all]↗2017-05-23
▶
Bugzilla
CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words↗2017-05-23
▶