CVE-2020-25644: High severity red hat wildfly and openssl vulnerability
Published Sep 22, 2020
·Updated
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Affected Software
73 affected componentsFixes available
redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el6ea
0:2.9.0-6.redhat_00016.1.el6ea
redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el6ea
0:1.2.0-1.redhat_00007.1.el6ea
redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el6ea
0:1.1.0-1.redhat_00007.1.el6ea
redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el6ea
0:3.2.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el6ea
0:6.0.21-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-annotations<0:2.10.4-1.redhat_00002.1.el6ea
0:2.10.4-1.redhat_00002.1.el6ea
redhat/eap7-jackson-core<0:2.10.4-1.redhat_00002.1.el6ea
0:2.10.4-1.redhat_00002.1.el6ea
redhat/eap7-jackson-coreutils<0:1.6.0-1.redhat_00006.1.el6ea
0:1.6.0-1.redhat_00006.1.el6ea
redhat/eap7-jackson-jaxrs-providers<0:2.10.4-1.redhat_00002.1.el6ea
0:2.10.4-1.redhat_00002.1.el6ea
redhat/eap7-jackson-modules-base<0:2.10.4-3.redhat_00002.1.el6ea
0:2.10.4-3.redhat_00002.1.el6ea
redhat/eap7-jackson-modules-java8<0:2.10.4-1.redhat_00002.1.el6ea
0:2.10.4-1.redhat_00002.1.el6ea
redhat/eap7-jasypt<0:1.9.3-1.redhat_00002.1.el6ea
0:1.9.3-1.redhat_00002.1.el6ea
redhat/eap7-jboss-marshalling<0:2.0.10-1.Final_redhat_00001.1.el6ea
0:2.0.10-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-remoting<0:5.0.19-1.Final_redhat_00001.1.el6ea
0:5.0.19-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-3.Final_redhat_00004.1.el6ea
0:1.7.2-3.Final_redhat_00004.1.el6ea
redhat/eap7-jboss-xnio-base<0:3.7.11-1.Final_redhat_00001.1.el6ea
0:3.7.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.32-1.SP1_redhat_00001.1.el6ea
0:2.0.32-1.SP1_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.4-3.GA_redhat_00003.1.el6ea
0:7.3.4-3.GA_redhat_00003.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.9-1.Final_redhat_00001.1.el6ea
0:1.10.9-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-openssl<0:1.0.12-1.Final_redhat_00001.1.el6ea
0:1.0.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el7ea
0:2.9.0-6.redhat_00016.1.el7ea
redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el7ea
0:1.2.0-1.redhat_00007.1.el7ea
redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el7ea
0:1.1.0-1.redhat_00007.1.el7ea
redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el7ea
0:3.2.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el7ea
0:6.0.21-1.Final_redhat_00001.1.el7ea
redhat/eap7-jackson-annotations<0:2.10.4-1.redhat_00002.1.el7ea
0:2.10.4-1.redhat_00002.1.el7ea
redhat/eap7-jackson-core<0:2.10.4-1.redhat_00002.1.el7ea
0:2.10.4-1.redhat_00002.1.el7ea
redhat/eap7-jackson-coreutils<0:1.6.0-1.redhat_00006.1.el7ea
0:1.6.0-1.redhat_00006.1.el7ea
redhat/eap7-jackson-jaxrs-providers<0:2.10.4-1.redhat_00002.1.el7ea
0:2.10.4-1.redhat_00002.1.el7ea
redhat/eap7-jackson-modules-base<0:2.10.4-3.redhat_00002.1.el7ea
0:2.10.4-3.redhat_00002.1.el7ea
redhat/eap7-jackson-modules-java8<0:2.10.4-1.redhat_00002.1.el7ea
0:2.10.4-1.redhat_00002.1.el7ea
redhat/eap7-jasypt<0:1.9.3-1.redhat_00002.1.el7ea
0:1.9.3-1.redhat_00002.1.el7ea
redhat/eap7-jboss-marshalling<0:2.0.10-1.Final_redhat_00001.1.el7ea
0:2.0.10-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-remoting<0:5.0.19-1.Final_redhat_00001.1.el7ea
0:5.0.19-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-3.Final_redhat_00004.1.el7ea
0:1.7.2-3.Final_redhat_00004.1.el7ea
redhat/eap7-jboss-xnio-base<0:3.7.11-1.Final_redhat_00001.1.el7ea
0:3.7.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.32-1.SP1_redhat_00001.1.el7ea
0:2.0.32-1.SP1_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.4-3.GA_redhat_00003.1.el7ea
0:7.3.4-3.GA_redhat_00003.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.9-1.Final_redhat_00001.1.el7ea
0:1.10.9-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-openssl<0:1.0.12-1.Final_redhat_00001.1.el7ea
0:1.0.12-1.Final_redhat_00001.1.el7ea
redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el8ea
0:2.9.0-6.redhat_00016.1.el8ea
redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el8ea
0:1.2.0-1.redhat_00007.1.el8ea
redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el8ea
0:1.1.0-1.redhat_00007.1.el8ea
redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el8ea
0:3.2.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el8ea
0:6.0.21-1.Final_redhat_00001.1.el8ea
redhat/eap7-jackson-annotations<0:2.10.4-1.redhat_00002.1.el8ea
0:2.10.4-1.redhat_00002.1.el8ea
redhat/eap7-jackson-core<0:2.10.4-1.redhat_00002.1.el8ea
0:2.10.4-1.redhat_00002.1.el8ea
redhat/eap7-jackson-coreutils<0:1.6.0-1.redhat_00006.1.el8ea
0:1.6.0-1.redhat_00006.1.el8ea
redhat/eap7-jackson-jaxrs-providers<0:2.10.4-1.redhat_00002.1.el8ea
0:2.10.4-1.redhat_00002.1.el8ea
redhat/eap7-jackson-modules-base<0:2.10.4-3.redhat_00002.1.el8ea
0:2.10.4-3.redhat_00002.1.el8ea
redhat/eap7-jackson-modules-java8<0:2.10.4-1.redhat_00002.1.el8ea
0:2.10.4-1.redhat_00002.1.el8ea
redhat/eap7-jasypt<0:1.9.3-1.redhat_00002.1.el8ea
0:1.9.3-1.redhat_00002.1.el8ea
redhat/eap7-jboss-marshalling<0:2.0.10-1.Final_redhat_00001.1.el8ea
0:2.0.10-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-remoting<0:5.0.19-1.Final_redhat_00001.1.el8ea
0:5.0.19-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-3.Final_redhat_00004.1.el8ea
0:1.7.2-3.Final_redhat_00004.1.el8ea
redhat/eap7-jboss-xnio-base<0:3.7.11-1.Final_redhat_00001.1.el8ea
0:3.7.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.32-1.SP1_redhat_00001.1.el8ea
0:2.0.32-1.SP1_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.4-3.GA_redhat_00003.1.el8ea
0:7.3.4-3.GA_redhat_00003.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.9-1.Final_redhat_00001.1.el8ea
0:1.10.9-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-openssl<0:1.0.12-1.Final_redhat_00001.1.el8ea
0:1.0.12-1.Final_redhat_00001.1.el8ea
redhat/wildfly-openssl<1.1.3.
1.1.3.
maven/org.wildfly.openssl:wildfly-openssl-natives-parent<1.1.3.Final
1.1.3.Final
redhat WildFly OpenSSL<1.1.3
redhat Data Grid=8.0
redhat Jboss Data Grid=7.0
redhat JBoss Enterprise Application Platform=7.0.0
redhat Jboss Fuse=7.0.0
redhat Openshift Application Runtimes
redhat Single Sign-on=7.0
NetApp OnCommand Insight
NetApp OnCommand Workflow Automation
NetApp Service Level Manager
redhat Jboss Data Grid=7.0.0
Remediation
Patch Available
Information
There is currently no known mitigation for this issue.
Event History
Sep 22, 2020
CVE Published
12:00 AM
Oct 6, 2020
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via Red Hat·06:15 AM
DescriptionSeverityAffected Software
May 24, 2022
Advisory Published
via GitHub·05:30 PM
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2020-25644?
CVE-2020-25644 has a high severity rating as it can lead to a denial of service by causing out-of-memory (OOM) conditions.
2
How do I fix CVE-2020-25644?
To fix CVE-2020-25644, upgrade to WildFly OpenSSL version 1.1.3.Final or later.
3
Which versions of WildFly are affected by CVE-2020-25644?
Versions of WildFly OpenSSL prior to 1.1.3.Final are affected by CVE-2020-25644.
4
What type of vulnerability is CVE-2020-25644?
CVE-2020-25644 is a memory leak vulnerability that can affect system availability.
5
What should organizations using WildFly do regarding CVE-2020-25644?
Organizations should assess their WildFly OpenSSL versions and apply the necessary updates to mitigate the vulnerability.