{"action":"opened","issue":{"url":"https://api.github.com/repos/ioswinews/hadoop/issues/33","repository_url":"https://api.github.com/repos/ioswinews/hadoop","labels_url":"https://api.github.com/repos/ioswinews/hadoop/issues/33/labels{/name}","comments_url":"https://api.github.com/repos/ioswinews/hadoop/issues/33/comments","events_url":"https://api.github.com/repos/ioswinews/hadoop/issues/33/events","html_url":"https://github.com/ioswinews/hadoop/issues/33","id":360697328,"node_id":"MDU6SXNzdWUzNjA2OTczMjg=","number":33,"title":"CVE-2017-5637 high severity vulnerability detected by WhiteSource","user":{"login":"bolt-for-github[bot]","id":42819689,"node_id":"MDM6Qm90NDI4MTk2ODk=","avatar_url":"https://avatars0.githubusercontent.com/u/1539627?v=4","gravatar_id":"","url":"https://api.github.com/users/bolt-for-github%5Bbot%5D","html_url":"https://github.com/apps/bolt-for-github","followers_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/followers","following_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/repos","events_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/bolt-for-github%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-17T01:00:07Z","updated_at":"2018-09-17T01:00:07Z","closed_at":null,"author_association":"NONE","body":"## CVE-2017-5637 - High Vulnerability\n<details><summary>:warning: Vulnerable Library - <b>zookeeper-3.4.9.jar</b></p></summary>\n<p>path: /root/.m2/repository/org/apache/zookeeper/zookeeper/3.4.9/zookeeper-3.4.9.jar,2/repository/org/apache/zookeeper/zookeeper/3.4.9/zookeeper-3.4.9.jar</p>\n<p>\n\nDependency Hierarchy:\n  - :x: **zookeeper-3.4.9.jar** (Vulnerable Library)\n</p>\n</details>\n<p></p>\n<details><summary>:red_circle: Vulnerability Details</summary>\n<p>  \n  \nTwo four letter word commands \"wchp/wchc\" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.\n\n<p>Publish Date: 2017-10-10\n<p>URL: <a href=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5637>CVE-2017-5637</a></p>\n</p>\n</details>\n<p></p>\n<details><summary>:dart: CVSS 3 Score Details (<b>7.5</b>)</summary>\n<p>\n\nBase Score Metrics:\n- Exploitability Metrics:\n  - Attack Vector: Network\n  - Attack Complexity: Low\n  - Privileges Required: None\n  - User Interaction: None\n  - Scope: Unchanged\n- Impact Metrics:\n  - Confidentiality Impact: None\n  - Integrity Impact: None\n  - Availability Impact: High\n</p>\nFor more information on CVSS3 Scores, click <a href=\"https://www.first.org/cvss/calculator/3.0\">here</a>.\n</p>\n</details>\n<p></p>\n<details><summary>:white_check_mark: Suggested Fix</summary>\n<p>\n\n<p>Type: Change files</p>\n<p>Origin: <a href=\"https://github.com/apache/zookeeper/commit/5fe68506f217246c7ebd96803f9c78e13ec2f11a\">https://github.com/apache/zookeeper/commit/5fe68506f217246c7ebd96803f9c78e13ec2f11a</a></p>\n<p>Release Date: 2017-03-04</p>\n<p>Fix Resolution: Replace or update the following files: NIOServerCnxn.java, ZKTestCase.java, zookeeperAdmin.xml, FourLetterCommands.java, NopCommand.java, NettyServerCnxn.java, FourLetterWordsWhiteListTest.java</p>\n\n</p>\n</details>\n<p></p>\n\n***\nWant to learn more about the open source vulnerabilities in your products? Click [here](https://www.whitesourcesoftware.com)"}}
{"actor":{"display_login":"bolt-for-github"}}