REDHAT-BUG-2483133: High severity Red Hat JBoss EAP vulnerability
original reporting: https://docs.google.com/document/d/1Rf4NtLudECimDNy8F9clUblm6Avx8yF/edit
DoS — ChunkReader TrailerParser unbounded HeaderMap accumulation (chunked trailer OOM) (JBoss EAP)
JBoss EAP's Undertow HTTP/1.1 chunked-transfer decoder places no size or count limits on the trailer section that follows the terminal 0\r\n chunk, and trailer bytes are not counted against the configured max-entity-size limit; a single unauthenticated TCP connection streaming an arbitrarily large trailer value drives the JVM to OutOfMemoryError, taking down all deployments on the listener — this is fully mitigated when a re-framing L7 reverse proxy (nginx, HAProxy in http-mode, ALB) sits in front, but applies to direct-edge and L4/TCP load-balanced deployments. findings/jboss-eap68.md
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Place an L7 reverse proxy (nginx, HAProxy in http-mode, or ALB) in front of JBoss EAP so requests are re-framed by the proxy; this fully mitigates the chunked trailer unbounded HeaderMap accumulation OOM when using direct-edge and L4/TCP load-balanced deployments.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2483133?
The severity of REDHAT-BUG-2483133 is high, rated at 7.
What does REDHAT-BUG-2483133 vulnerability affect?
The REDHAT-BUG-2483133 vulnerability affects Red Hat JBoss EAP's Undertow HTTP/1.1 chunked-transfer decoder.
How does REDHAT-BUG-2483133 impact systems?
REDHAT-BUG-2483133 can lead to a denial of service (DoS) due to unbounded HeaderMap accumulation.
How can I mitigate the risk of REDHAT-BUG-2483133?
To mitigate the risk of REDHAT-BUG-2483133, apply available patches provided by Red Hat for JBoss EAP.
What is the main issue caused by REDHAT-BUG-2483133?
The main issue caused by REDHAT-BUG-2483133 is the potential for an out-of-memory (OOM) condition during processing of chunked trailer data.