Description
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Remediation
References
http://www.debian.org/security/2017/dsa-3871
http://www.securityfocus.com/bid/98814
https://access.redhat.com/errata/RHSA-2017:2477
https://access.redhat.com/errata/RHSA-2017:3354
https://access.redhat.com/errata/RHSA-2017:3355
https://issues.apache.org/jira/browse/ZOOKEEPER-2693
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370%40%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
Related Vulnerabilities
CVE-2018-3754 Vulnerability in npm package query-mysql
CVE-2020-7660 Vulnerability in maven package org.webjars.npm:serialize-javascript
CVE-2020-14966 Vulnerability in maven package org.webjars.npm:jsrsasign
CVE-2018-17421 Vulnerability in maven package com.zrlog:zrlog
CVE-2018-16469 Vulnerability in maven package org.webjars.npm:merge