CVE-2016-2094: High severity jboss enterprise application platform vulnerability
It was reported that HTTPS NIO connector uses no timeout when reading SSL handshake from a client to tie up a thread on the server just by creating a socket. Attacker could create socket and then never sends the handshake or any data at all, which causes the thread to remain occupied indefinitely so long as the socket remains open.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1307039
Other sources
The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2094?
CVE-2016-2094 has been classified as a medium severity vulnerability.
How do I fix CVE-2016-2094?
To fix CVE-2016-2094, update to the latest version of Red Hat JBoss Enterprise Application Platform that includes the necessary security patches.
What impact does CVE-2016-2094 have on JBoss?
CVE-2016-2094 can lead to a denial of service on JBoss by exhausting server threads through an attacker creating sockets without completing the SSL handshake.
Which versions of JBoss are affected by CVE-2016-2094?
CVE-2016-2094 specifically affects Red Hat JBoss Enterprise Application Platform version 6.4.6.
Is there a workaround for CVE-2016-2094?
There are no known workarounds for CVE-2016-2094, so applying the patch is the recommended solution.