CVE-2022-25897
First published: Thu Sep 08 2022(Updated: )
The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
Credit: report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse Milo | <0.6.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
- https://github.com/eclipse/milo/issues/1030
- https://github.com/eclipse/milo/pull/1031
- https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191
- https://www.cve.org/CVERecord?id=CVE-2022-25897 https://nvd.nist.gov/vuln/detail/CVE-2022-25897
- https://bugzilla.redhat.com/show_bug.cgi?id=2136188
- https://access.redhat.com/errata/RHSA-2022:8902
- https://access.redhat.com/security/cve/cve-2022-25897
Frequently Asked Questions
What is CVE-2022-25897?
CVE-2022-25897 is a vulnerability in the Eclipse Milo SDK Server that allows an attacker to cause a Denial of Service by sending multiple CloseSession requests.
How severe is CVE-2022-25897?
CVE-2022-25897 has a severity rating of 7.5 (high).
What is the affected software?
The affected software is the org.eclipse.milo:sdk-server package before version 0.6.8.
What is the fix for CVE-2022-25897?
To fix CVE-2022-25897, update the affected org.eclipse.milo:sdk-server package to version 0.6.8 or higher.
What is the Common Weakness Enumeration (CWE) for CVE-2022-25897?
The CWE for CVE-2022-25897 is CWE-770 (Use of One-way Hash without a Salt).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-25897
- agent/software-canonical-lookup
- collector/redhat-cve
- vendor/eclipse
- canonical/eclipse milo
- package-manager/redhat