PT-2020-16805 · Red Hat · Wildfly

Michael Kaplan · Published 2020-12-08 · Updated 2024-03-06 · CVE-2020-27822

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Wildfly versions 19.0.0.Final through 21.0.0.Final

Description A flaw in Wildfly allows for a memory leak when an application uses the OpenTracing API's java-interceptors. This issue can be exploited by an attacker to impact the availability of the server, with the highest threat being to system availability.

Recommendations For versions 19.0.0.Final through 21.0.0.Final, update to a version that includes a fix for this issue to prevent potential memory leaks and impact on system availability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BIT-WILDFLY-2020-27822

CVE-2020-27822

GHSA-QX3P-9MMP-4V8H

RHSA-2021:0246

RHSA-2021:0247

RHSA-2021:0248

Affected Products

Wildfly

References · 12

• https://bugzilla.redhat.com/show_bug.cgi?id=1904060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27822 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27822 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qx3p-9mmp-4v8h · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wildfly-2020-27822 · Vendor Advisory
• https://github.com/wildfly/wildfly · Note
• https://github.com/wildfly/wildfly/pull/13779 · Note
• https://github.com/wildfly/wildfly/commit/c8b02f6a0605f4e2abfeaf21d28b7fe76171004b · Note
• https://github.com/wildfly/wildfly/pull/13749 · Note
• https://github.com/wildfly/wildfly/commit/67ef84fd7aab789a535b137e5e506fd29d212455 · Note
• https://t.me/cibsecurity/17227 · Telegram Post
• https://issues.redhat.com/browse/WFLY-14094 · Note