Skip to content
OpenAdvisories
High · 7.5 CVE-2020-25644 EUVD-2022-4242GHSA-hxj4-885f-grgp

Wildfly-OpenSSL memory leak flaw

Published Oct 6, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Package: org.wildfly.openssl:wildfly-openssl-natives-parent Ecosystem: Maven

Description

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

Affected products

VendorProductAffectedFixed
— wildfly-openssl before wildfly-openssl 1.1.3.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-glassfish-el +1 3.0.1-4.b08_redhat_00005.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hibernate +5 5.1.17-3.Final_redhat_00004.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-ejb-client 4.0.12-1.Final_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-2.Final_redhat_00003.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.11-4.GA_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron 1.1.14-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-http-client +4 1.0.21-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-naming-client 1.0.13-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl +1 1.0.12-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl-linux 1.0.12-6.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-6.redhat_00016.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-fge-btf 1.2.0-1.redhat_00007.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-fge-msg-simple 1.1.0-1.redhat_00007.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-hal-console 3.2.11-1.Final_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-hibernate-validator +1 6.0.21-1.Final_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jackson-core +7 2.10.4-1.redhat_00002.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jackson-coreutils 1.6.0-1.redhat_00006.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jackson-modules-base +1 2.10.4-3.redhat_00002.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jasypt 1.9.3-1.redhat_00002.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jboss-marshalling +1 2.0.10-1.Final_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.19-1.Final_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-3.Final_redhat_00004.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.11-1.Final_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-undertow 2.0.32-1.SP1_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.4-3.GA_redhat_00003.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.9-1.Final_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.4-3.GA_redhat_00003.1.el7eap RHSA-2020:5341
Red Hat JBoss EAP 7 eap7-wildfly-openssl +1 1.0.12-1.Final_redhat_00001.1.el6eap RHSA-2020:5342, RHSA-2020:5341, RHSA-2020:5340
Red Hat JBoss EAP 7 eap7-wildfly-openssl-linux-x86_64 1.0.11-1.Final_redhat_00001.1.el6eap RHSA-2020:4922, RHSA-2020:4256

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly.openssl:wildfly-openssl-natives-parent < 1.1.3.Final 1.1.3.Final GHSA-hxj4-885f-grgp

Advisories 7

References