REDHAT-BUG-1893070
First published: Fri Oct 30 2020(Updated: )
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability. * Reference: <a href="https://issues.redhat.com/browse/WFCORE-5105">https://issues.redhat.com/browse/WFCORE-5105</a> * Upstream patch: <a href="https://github.com/wildfly/wildfly-core/pull/4308">https://github.com/wildfly/wildfly-core/pull/4308</a> * Affected artifacts: wildfly-host-controller-VERSION.jar wildfly-protocol-VERSION.jar jboss-cli-client.jar
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat WildFly and OpenSSL | <21.0.0.Final |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://issues.redhat.com/browse/WFCORE-5105
- https://github.com/wildfly/wildfly-core/pull/4308
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://access.redhat.com/errata/RHSA-2021:0250
- https://access.redhat.com/errata/RHSA-2021:0246
- https://access.redhat.com/errata/RHSA-2021:0247
- https://access.redhat.com/errata/RHSA-2021:0248
- https://access.redhat.com/security/cve/cve-2020-25689
- https://access.redhat.com/errata/RHSA-2021:0327
- https://access.redhat.com/errata/RHSA-2021:0295
- https://access.redhat.com/errata/RHSA-2022:5532
- https://bugzilla.redhat.com/show_bug.cgi?id=1893070
Frequently Asked Questions
What is the severity of REDHAT-BUG-1893070?
REDHAT-BUG-1893070 is considered a critical vulnerability due to its potential to cause Out of Memory (OOM) issues.
How do I fix REDHAT-BUG-1893070?
To fix REDHAT-BUG-1893070, upgrade to WildFly version 21.0.1.Final or later where the memory leak flaw has been addressed.
Which versions are affected by REDHAT-BUG-1893070?
REDHAT-BUG-1893070 affects all versions of WildFly up to and including version 21.0.0.Final.
What components are impacted by REDHAT-BUG-1893070?
REDHAT-BUG-1893070 impacts the WildFly server's host-controller that attempts to reconnect to the domain-controller.
What type of vulnerability is REDHAT-BUG-1893070?
REDHAT-BUG-1893070 is classified as a memory leak vulnerability affecting the connection handling in WildFly.
- agent/references
- agent/type
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-25689
- agent/first-publish-date
- agent/source
- agent/description
- agent/severity
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat wildfly and openssl