PT-2024-38985 · Eclipse · Eclipse Vert.X

Julien Viet · Published 2024-09-04 · Updated 2024-11-13 · CVE-2024-8391

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Eclipse Vert.x versions 4.3.0 through 4.5.9

Description: The gRPC server in Eclipse Vert.x does not limit the maximum length of message payload, which can lead to potential issues. This issue does not affect the Vert.x gRPC server based on grpc-java and Netty libraries. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For Eclipse Vert.x versions 4.3.0 through 4.5.9, update to version 4.5.10 or later to fix the issue. As a temporary workaround, consider restricting the maximum length of message payload in the gRPC server configuration to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-8391

GHSA-G76F-GJFX-4RPR

Affected Products

Eclipse Vert.X

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-8391 · Security Note
• https://osv.dev/vulnerability/GHSA-g76f-gjfx-4rpr · Vendor Advisory
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/31 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8391 · Vendor Advisory
• https://github.com/eclipse-vertx/vertx-grpc/issues/113 · Note
• https://github.com/eclipse-vertx/vertx-grpc/commit/a76b14a92410c89fcc590c5852d800b565916ccf · Note
• https://github.com/eclipse-vertx/vertx-grpc · Note
• https://twitter.com/vertx_project/status/1856650973499777262 · Twitter Post
• https://t.me/cvenotify/93314 · Telegram Post
• https://t.me/cvenotify/94386 · Telegram Post
• https://twitter.com/CVEnew/status/1831354570561159311 · Twitter Post
• https://twitter.com/vertx_project/status/1831367053472887117 · Twitter Post
• https://t.me/cvedetector/4801 · Telegram Post