PT-2021-11779 · Red Hat · Jboss-Remoting

Published 2021-06-02 · Updated 2022-03-18 · CVE-2020-35510

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: jboss-remoting versions before 5.0.20.SP1-redhat-00001

Description: A flaw was found in jboss-remoting that allows a malicious attacker to cause threads to hold up forever in the EJB server. This can be achieved by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or by tampering with jboss-remoting code and deleting the lines that send the ACK message from the EJB client code. The result is a denial of service, with the highest threat being to system availability.

Recommendations: For versions before 5.0.20.SP1-redhat-00001, update to version 5.0.20.SP1-redhat-00001 or later to resolve the issue. As a temporary workaround, consider restricting access to the EJB server to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-35510

GHSA-P6J8-HGV5-M35G

RHSA-2021:0872

RHSA-2021:0873

RHSA-2021:0874

Affected Products

Jboss-Remoting

References · 5

• https://osv.dev/vulnerability/GHSA-p6j8-hgv5-m35g · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1905796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35510 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35510 · Vendor Advisory
• https://t.me/cvenotify/15394 · Telegram Post