Description
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Remediation
References
http://www.debian.org/security/2017/dsa-3871
http://www.securityfocus.com/bid/98814
https://access.redhat.com/errata/RHSA-2017:2477
https://access.redhat.com/errata/RHSA-2017:3354
https://access.redhat.com/errata/RHSA-2017:3355
https://issues.apache.org/jira/browse/ZOOKEEPER-2693
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370%40%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
Related Vulnerabilities
CVE-2020-7717 Vulnerability in npm package dot-notes
CVE-2019-20503 Vulnerability in npm package electron
CVE-2017-16184 Vulnerability in npm package scott-blanch-weather-app
CVE-2023-34617 Vulnerability in maven package com.owlike:genson
CVE-2021-32859 Vulnerability in maven package org.webjars.npm:github-com-baremetrics-calendar