Skip to content
OpenAdvisories
High · 7.5 CVE-2020-35510 EUVD-2022-1490GHSA-p6j8-hgv5-m35g

Uncontrolled Resource Consumption in jboss-remoting

Published Jun 2, 2021 · Updated Aug 4, 2024 · Assigned by redhat

Package: org.jboss.remoting:jboss-remoting Ecosystem: Maven

Description

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected products

VendorProductAffectedFixed
— jboss-remoting jboss-remoting 5.0.20.SP1-redhat-00001 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-9.redhat_00019.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-bouncycastle +3 1.68.0-1.redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-guava +1 30.1.0-1.redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-guava-failureaccess 1.0.1-1.redhat_00002.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-hal-console 3.2.13-1.Final_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.27-1.Final_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.39-1.SP1_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.1.18-1.Final_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.20-2.SP1_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-5.Final_redhat_00006.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.11-1.Final_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-undertow 2.0.34-1.SP1_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.6-1.GA_redhat_00002.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.11-1.Final_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.25-1.Final_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.6-1.GA_redhat_00002.1.el7eap RHSA-2021:0873
Red Hat JBoss EAP 7 eap7-wildfly-naming-client 1.0.14-1.Final_redhat_00001.1.el6eap RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jboss.remoting:jboss-remoting < 5.0.20.Final 5.0.20.Final GHSA-p6j8-hgv5-m35g

Advisories 4

References