PT-2020-16663 · Eclipse · Eclipse Hono

Kai Hudalla · Published 2020-11-13 · Updated 2022-02-10 · CVE-2020-27217

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Hono versions 1.3.0 through 1.4.0

Description The AMQP protocol adapter in Eclipse Hono does not verify the size of AMQP messages received from devices. A device may send messages that are bigger than the max-message-size indicated during link establishment, which could be exploited by a hand crafted AMQP 1.0 client to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.

Recommendations For Eclipse Hono versions 1.3.0 and 1.4.0, consider implementing size verification for AMQP messages received from devices to prevent potential out of memory exceptions. As a temporary workaround, restrict the maximum allowed message size to prevent unlimited size messages from being sent to the adapter. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2020-27217

GHSA-9F52-HPVW-V96W

Affected Products

Eclipse Hono

References · 5

• https://osv.dev/vulnerability/CVE-2020-27217 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=567068 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27217 · Security Note
• https://osv.dev/vulnerability/GHSA-9f52-hpvw-v96w · Vendor Advisory
• https://t.me/cibsecurity/16326 · Telegram Post