Skip to content
OpenAdvisories
High · 7.5 CVE-2017-12174 EUVD-2022-3937GHSA-gc96-h5pr-839j

Uncontrolled Resource Consumption in Artemis and HornetQ

Published Mar 7, 2018 · Updated Aug 5, 2024 · Assigned by redhat

Vendor: Red Hat Product: HornetQ/Artemis Package: org.apache.activemq:artemis-native Package: org.hornetq:hornetq-server Ecosystem: Maven

Description

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.

Affected products

VendorProductAffectedFixed
Red Hat HornetQ/Artemis before 2.4.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 1.5.5.009-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.1.13-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.2.13-6.SP5_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-hibernate +5 5.1.12-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-infinispan +5 8.2.9-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.7-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jackson-core +9 2.8.11-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jboss-ec2-eap +1 7.1.1-3.1.GA_redhat_3.ep7.el6 RHSA-2018:0481
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.0.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jboss-server-migration +18 1.0.3-6.Final_redhat_6.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-jbossws-cxf 5.1.10-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-narayana +10 5.5.31-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-10.SP9_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-resteasy +16 3.0.25-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-undertow 1.4.18-4.SP2_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-undertow-jastow 2.0.3-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly +1 7.1.1-4.GA_redhat_2.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.1.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.9-1.Final_redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wildfly-javadocs 7.1.1-3.GA_redhat_2.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-wss4j +6 2.1.11-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 7 eap7-xml-security 2.0.9-1.redhat_1.1.ep7.el6 RHSA-2018:0480, RHSA-2018:0479
Red Hat JBoss EAP 6 hornetq 2.3.25-25.SP23_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 infinispan +4 5.2.23-1.Final_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 ironjacamar-eap6 +9 1.0.41-1.Final_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 jboss-as-ee +62 7.5.19-2.Final_redhat_2.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 jboss-ec2-eap +1 7.5.19-2.Final_redhat_2.ep6.el6 RHSA-2018:0275
Red Hat JBoss EAP 6 jboss-ejb-client 1.0.40-1.Final_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 jboss-remoting3 3.3.12-2.Final_redhat_2.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 jbossweb 7.5.27-1.Final_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 jbossws-cxf 4.3.7-1.Final_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 picketlink-bindings 2.5.4-22.SP18_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268
Red Hat JBoss EAP 6 picketlink-federation 2.5.4-20.SP18_redhat_1.1.ep6.el5 RHSA-2018:0271, RHSA-2018:0270, RHSA-2018:0268

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.activemq:artemis-native < 2.4.0 2.4.0 GHSA-gc96-h5pr-839j
Maven org.hornetq:hornetq-server < 2.4.0.Final 2.4.0.Final GHSA-gc96-h5pr-839j

Advisories 8

References