Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1454808 - (CVE-2017-5637) CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words
CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four lette...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20170207,repor...
: Security
Depends On: 1454809 1455642 1455643
Blocks: 1454810 1475996 1500872
  Show dependency tree / graph
 
Reported: 2017-05-23 09:43 EDT by Andrej Nemec
Modified: 2018-02-12 06:18 EST (History)
29 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A denial of service vulnerability was discovered in ZooKeeper which allows an attacker to dramatically increase CPU utilization by abusing "wchp/wchc" commands, leading to the server being unable to serve legitimate requests.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-11-30 11:58:57 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2477 normal SHIPPED_LIVE Important: Red Hat JBoss Data Virtualization 6.3 Update 7 security update 2017-08-15 15:07:56 EDT
Red Hat Product Errata RHSA-2017:3354 normal SHIPPED_LIVE Moderate: Red Hat JBoss BRMS 6.4.7 security update 2017-11-30 16:47:01 EST
Red Hat Product Errata RHSA-2017:3355 normal SHIPPED_LIVE Moderate: Red Hat JBoss BPM Suite 6.4.7 security update 2017-11-30 16:46:10 EST

  None (edit)
Description Andrej Nemec 2017-05-23 09:43:38 EDT 
Two four letter word commands “wchp/wchc” are CPU intensive and could cause spike of CPU utilization on ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests.

Upstream issue:

https://issues.apache.org/jira/browse/ZOOKEEPER-2693

References:

https://vulners.com/exploitdb/EDB-ID:41277
Comment 1 Andrej Nemec 2017-05-23 09:44:23 EDT 
Created zookeeper tracking bugs for this issue:

Affects: fedora-all [bug 1454809]
Comment 5 Pavel Polischouk 2017-07-24 14:32:59 EDT 
taking
Comment 6 Hooman Broujerdi 2017-07-24 22:19:07 EDT 
For fuse the recommended security practice to mitigate this issue is to deploy and operate zookeeper in a secured network where essentially the affected port are protected by the firewall. Additionally it should be assumed that only admin has access to the affected port and this port should not be made available to the world.
Comment 7 Christopher Tubbs 2017-07-24 22:57:38 EDT 
I agree. ZooKeeper isn't designed to be run as a publicly available service. It's designed to be a coordination system for distributed applications deployed within a well-designed cluster architecture.

If the input validation is buggy, that's certainly something to be addressed... but I'm not sure I'd call it a "security" bug, when the real security bug is the user operating it in an environment it wasn't designed for.

That said, ZooKeeper is *very* stable in its API, from what I've seen, and it's generally *very* low risk to upgrade to the latest version to fix any known bugs, provided the dependencies are available.
Comment 8 errata-xmlrpc 2017-08-15 11:09:21 EDT 
This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization

Via RHSA-2017:2477 https://access.redhat.com/errata/RHSA-2017:2477
Comment 9 errata-xmlrpc 2017-11-30 11:46:50 EST 
This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite

Via RHSA-2017:3355 https://access.redhat.com/errata/RHSA-2017:3355
Comment 10 errata-xmlrpc 2017-11-30 11:48:17 EST 
This issue has been addressed in the following products:

  Red Hat JBoss BRMS

Via RHSA-2017:3354 https://access.redhat.com/errata/RHSA-2017:3354
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.