Skip to content
OpenAdvisories
Medium · 5.9 CVE-2020-14340 EUVD-2021-1308GHSA-c738-77x8-wmq5

Uncontrolled Resource Consumption in XNIO

Published Jun 2, 2021 · Updated Aug 4, 2024 · Assigned by redhat

Package: jboss-xnio Package: jboss-xnio Package: org.jboss.xnio:xnio-nio Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.

Affected products

VendorProductAffectedFixed
— XNIO xnio 3.7.9.Final, xnio 3.8.2.Final, xnio 3.9.0.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jboss-xnio 3.8.2-1 —
Debian 13 jboss-xnio 3.8.2-1 —
Debian 12 jboss-xnio 3.8.2-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jboss-xnio No fix yet —
Ubuntu 18.04 LTS jboss-xnio No fix yet —
Ubuntu 16.04 LTS jboss-xnio No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-5.redhat_00011.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-activemq-artemis-native 1:1.0.2-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-apache-commons-codec 1.14.0-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-apache-commons-lang 3.10.0-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.3.7-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-artemis-native +1 1:1.0.2-3.redhat_1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-bouncycastle +3 1.65.0-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.9-11.SP12_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-hal-console 3.2.10-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.18-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-httpcomponents-client 4.5.12-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-httpcomponents-core 4.4.13-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-jberet +1 1.3.7-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-jboss-invocation 1.5.3-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.1.17-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-2.Final_redhat_00002.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.9-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-jgroups 4.1.10-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.9-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.3-8.Final_redhat_00007.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-picketlink-bindings +1 2.5.5-25.SP12_redhat_00013.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-snakeyaml 1.26.0-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-undertow 2.0.31-1.SP1_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-velocity +1 2.2.0-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.3-4.GA_redhat_00004.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.8-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.3-4.GA_redhat_00004.1.el7eap RHSA-2020:4246
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.13-1.Final_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-ws-commons-XmlSchema 2.2.5-1.redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244
Red Hat JBoss EAP 7 eap7-xerces-j2 2.12.0-2.SP03_redhat_00001.1.el6eap RHSA-2020:4246, RHSA-2020:4245, RHSA-2020:4244

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jboss.xnio:xnio-nio >= 3.8.0.Final, < 3.8.2.Final 3.8.2.Final GHSA-c738-77x8-wmq5
Maven org.jboss.xnio:xnio-nio >= 3.6.0, < 3.7.9.Final 3.7.9.Final GHSA-c738-77x8-wmq5

Advisories 5

References