Apache ZooKeeper 3.5
Apache ZooKeeper 3.5
The Apache ZooKeeper 3.5 reached end of service life on Jun 1, 2022 — Apache ZooKeeper no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Apache ZooKeeper 3.5 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- zookeeper
- release
- 3.5
- product Label
- Apache ZooKeeper
- release Label
- 3.5
- codename
- lts
- latest Version
- 3.5.10
- release Date
- 2019-05-03
- maintained
- source Url
- https://endoflife.date/zookeeper
Lifecycle Dates
- End of Service Life
- Jun 1, 2022
- Last OEM Support
- Mar 27, 2021
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Apache ZooKeeper 3.5 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Apache ZooKeeper 3.5?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Apache ZooKeeper 3.5 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Apache ZooKeeper 3.5 Support: Frequently Asked Questions
Is the Apache ZooKeeper 3.5 still supported?
Apache ZooKeeper ended support for the Apache ZooKeeper 3.5 on Jun 1, 2022 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Apache ZooKeeper 3.5 end of service life (EOSL) date?
Apache ZooKeeper lists the end of service life for the Apache ZooKeeper 3.5 as Jun 1, 2022.
Can I keep using the Apache ZooKeeper 3.5 after its EOSL date?
Yes. EOSL means Apache ZooKeeper stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Apache ZooKeeper 3.5 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Apache ZooKeeper 3.5
6 published CVEs affect the Apache ZooKeeper 3.5, including 4 rated critical or high severity. Apache ZooKeeper no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-44981 | CRITICAL | 9.1 | Oct 11, 2023 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propa |
| CVE-2016-5017 | HIGH | 8.1 | Sep 21, 2016 | Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have unspecified impact via a long command string. |
| CVE-2018-8012 | HIGH | 7.5 | May 21, 2018 | No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader. |
| CVE-2017-5637 | HIGH | 7.5 | Oct 10, 2017 | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later. |
| CVE-2021-21295 | MEDIUM | 5.9 | Mar 9, 2021 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTT |
| CVE-2019-0201 | MEDIUM | 5.9 | May 23, 2019 | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for |