You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@aurora.apache.org by GitBox <gi...@apache.org> on 2019/09/17 00:22:45 UTC
[GitHub] [aurora] larrycameron80 opened a new issue #76: Denial of Service
(DoS)
larrycameron80 opened a new issue #76: Denial of Service (DoS)
URL: https://github.com/apache/aurora/issues/76
Denial of Service (DoS)
Vulnerable module: org.apache.zookeeper:zookeeper
Introduced through: org.apache.zookeeper:zookeeper@3.4.8, org.apache.curator:curator-client@2.12.0 and others
Detailed paths
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.zookeeper:zookeeper@3.4.8
Remediation: Upgrade to org.apache.zookeeper:zookeeper@3.4.10.
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-framework@2.12.0 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8
Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.apache.curator:curator-recipes@2.12.0 › org.apache.curator:curator-framework@2.12.0 › org.apache.curator:curator-client@2.12.0 › org.apache.zookeeper:zookeeper@3.4.8
Overview
org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services.
Affected versions of this package are vulnerable to Denial of Service (DoS). Four letter zookeeper commands (such as wchp/wchc ) are not properly handled, which leads to the server unable to serve legitimate client requests.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services