CVE-2020-14326: High severity redhat Integration Camel K vulnerability
A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.
Other sources
The api calls are successfully routed by RestEasy, while this cache grows unbounded. Due to keys having the same hash code, each subsequent request gets slower as more cpu time is spent searching and adding the entry. A simple load generator could exploit this to make the endpoint unresponsive.
The media type itself is cached by MediaTypeHeaderDelegate, which protects itself by using a fixed size cache (default of 200) that is cleared when growing beyond the threshold. Since the RootNode cache is unbounded and not accessible, it is subject to this exploit.
References:
https://issues.redhat.com/browse/RESTEASY-2643
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/resteasyto a version that resolves this vulnerability.Fixed in 4.5.6. - Configuration
Configure RESTEasy RootNode route caching to use a fixed-size cache (default 200) that is cleared when it exceeds the threshold, preventing the unbounded growth that enables hash flooding DoS.
RESTEasy RootNode route cache RootNode cache size (fixed size cache threshold, default 200) = 200
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-14326.
What is the severity of CVE-2020-14326?
The severity of CVE-2020-14326 is high with a severity value of 7.
What is the impact of CVE-2020-14326?
CVE-2020-14326 can cause a denial of service by causing hash flooding, resulting in slower requests and higher CPU time.
Which software is affected by CVE-2020-14326?
RESTEasy version 4.5.6 is affected by CVE-2020-14326.
How can I fix CVE-2020-14326?
To fix CVE-2020-14326, update RESTEasy to version 4.5.7 or higher.