PT-2018-5378 · Red Hat+1 · Hornetq+1

Bharti Kundal + 1 · Published 2018-03-07 · Updated 2023-02-12 · CVE-2017-12174

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions HornetQ versions prior to 2.4.0 Artemis versions prior to 2.4.0

Description The issue occurs when Artemis and HornetQ are configured with UDP discovery and JGroups discovery, and an unexpected multicast message is received, resulting in the creation of a huge byte array. This may lead to heap memory exhaustion, full GC, or OutOfMemoryError.

Recommendations For HornetQ versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. For Artemis versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2017-12174

GHSA-GC96-H5PR-839J

RHSA-2018:0268

RHSA-2018:0270

RHSA-2018:0271

RHSA-2018:0275

RHSA-2018:0479

RHSA-2018:0480

RHSA-2018:0481

Affected Products

Artemis

Hornetq

References · 18

• https://access.redhat.com/errata/RHSA-2018:0478 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0275 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0269 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0481 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12174 · Security Note
• https://access.redhat.com/errata/RHSA-2018:0268 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0271 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0270 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gc96-h5pr-839j · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12174 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0480 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12174 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12174 · Note
• https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088@%3Ccommits.activemq.apache.org%3E · Note