Security Update for Zookeeper
Summary
DLA-986-1: zookeeper - security update. Affects zookeeper versions < 3.4.5+dfsg-2+deb7u1. Fixed in 3.4.5+dfsg-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zookeeper is a service used for maintaining configuration information. It allows distributed processes to coordinate with each other through a shared hierarchical namespace. Zookeeper is widely used in distributed systems to provide reliable coordination and synchronization. However, a vulnerability has been discovered in Zookeeper that could lead to a denial of service attack by consuming excessive CPU resources.
Vulnerability Detail
The vulnerability in Zookeeper is related to the wchp/wchc commands, which are computationally expensive. These commands were not properly restricted, allowing an attacker to abuse them and cause elevated CPU consumption. This could result in a denial of service attack, rendering the Zookeeper service unavailable to legitimate users. To mitigate this vulnerability, the new update disables these two commands by default. Users can selectively whitelist commands using the new configuration option 4lw.commands.whitelist.
How To Fix
Minimum fixed version
3.4.5+dfsg-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zookeeperTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can manually disable the wchp/wchc commands by modifying the Zookeeper configuration. This can be done by setting the 4lw.commands.whitelist option to exclude these commands. Alternatively, users can restore the full set of commands by using '*' in the whitelist.
Conclusion
The vulnerability in Zookeeper that allowed for a denial of service attack has been addressed in the latest update. It is recommended to upgrade the Zookeeper packages to ensure the security of your system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zookeeper →
FAQ
Zookeeper is a service used for maintaining configuration information and providing coordination among distributed processes.
The vulnerability allows an attacker to cause a denial of service by consuming excessive CPU resources, rendering the Zookeeper service unavailable.
To fix this vulnerability, upgrade the Zookeeper packages to version 3.4.5+dfsg-2+deb7u1 or later.
Yes, you can manually disable the wchp/wchc commands by modifying the Zookeeper configuration and excluding them from the 4lw.commands.whitelist option.
There is no specific workaround mentioned, but you can manually disable the vulnerable commands as mentioned above.
Related vulnerabilities
Recent vulnerabilities recorded for zookeeper.
