GitHub Advisoryadvisory · Maven

GHSA-p6j8-hgv5-m35g Uncontrolled Resource Consumption in jboss-remoting

HIGH Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2020-35510
Ecosystem
Maven
Packages
org.jboss.remoting:jboss-remoting
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-06-03

Affected packages

• Maven org.jboss.remoting:jboss-remoting: < 5.0.20.Final → fixed in 5.0.20.Final

Description

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Related

Alias · CVE (1)

  • CVE-2020-35510 A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References