Skip to content
OpenAdvisories
Medium · 5.9 CVE-2020-27822 BIT-wildfly-2020-27822EUVD-2022-5055GHSA-qx3p-9mmp-4v8h

Wildfly has a memory leak vulnerability

Published Dec 8, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Package: org.wildfly:wildfly-parent Ecosystem: Maven

Description

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.

Affected products

VendorProductAffectedFixed
— wildfly 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, 21.0.0.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-7.redhat_00017.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.9-12.SP13_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-hal-console 3.2.12-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.20-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-httpcomponents-client 4.5.13-1.redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.37-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.8-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-modules 1.11.0-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.20-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-4.Final_redhat_00005.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.12-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.10-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-opentracing-interceptors 0.0.4.1-2.redhat_00002.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-resteasy +19 3.11.3-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.5-2.GA_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-discovery +1 1.2.1-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.10-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.24-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.5-2.GA_redhat_00001.1.el7eap RHSA-2021:0247

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wildfly:wildfly-parent >= 19.0.0.Final, < 21.0.2.Final 21.0.2.Final GHSA-qx3p-9mmp-4v8h
Maven org.wildfly:wildfly-parent >= 22.0.0.Alpha1, < 22.0.0.Beta1 22.0.0.Beta1 GHSA-qx3p-9mmp-4v8h

Advisories 4

References