Bug 1885485 (CVE-2020-25644)
| Summary: | CVE-2020-25644 wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Ted Jongseok Won <jwon> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, drieden, eleandro, etirelli, fmarchio, ggaughan, gmalinko, ibek, iweiss, janstey, jawilson, jbalunas, jochrist, jpallich, jperkins, jstastny, jwon, krathod, kverlaen, kwills, lgao, lthon, mnovotny, msochure, msvehla, mszynkie, nwallace, pdrozd, pgallagh, pjindal, pmackay, rguimara, rrajasek, rruss, rstancel, rsvoboda, rsynek, sdaley, smaestri, sthorger, tom.jenkinson |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: |
https://issues.redhat.com/browse/ENTESB-14917 https://issues.redhat.com/browse/ENTSWM-917 https://issues.redhat.com/browse/JBEAP-20304 https://issues.redhat.com/browse/JDG-4140 https://issues.redhat.com/browse/JDG-4141 https://issues.redhat.com/browse/KEYCLOAK-15829 |
||
| Whiteboard: | |||
| Fixed In Version: | wildfly-openssl 1.1.3.Final | Doc Type: | If docs needed, set a value |
| Doc Text: |
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-10-14 20:21:13 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1885492 | ||
|
Description
Ted Jongseok Won
2020-10-06 06:15:58 UTC
Although Red Hat Fuse 7 distributes vulnerable wildfly-openssl artifacts, it does not use them and nowhere registers it as the SSL provider, for this reason the impact to Fuse is Low. This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2020:4257 https://access.redhat.com/errata/RHSA-2020:4257 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:4256 https://access.redhat.com/errata/RHSA-2020:4256 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25644 This issue has been addressed in the following products: EAP 7.3.3 Via RHSA-2020:4923 https://access.redhat.com/errata/RHSA-2020:4923 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:4922 https://access.redhat.com/errata/RHSA-2020:4922 This issue has been addressed in the following products: Red Hat Single Sign-On 7.4.3 one-off Via RHSA-2020:4978 https://access.redhat.com/errata/RHSA-2020:4978 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2020:5344 https://access.redhat.com/errata/RHSA-2020:5344 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Via RHSA-2020:5340 https://access.redhat.com/errata/RHSA-2020:5340 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Via RHSA-2020:5341 https://access.redhat.com/errata/RHSA-2020:5341 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:5342 https://access.redhat.com/errata/RHSA-2020:5342 This issue has been addressed in the following products: Red Hat Data Grid 7.3.8 Via RHSA-2020:5410 https://access.redhat.com/errata/RHSA-2020:5410 Mitigation: There is currently no known mitigation for this issue. This issue has been addressed in the following products: Red Hat Data Grid 8.1.1 Via RHSA-2021:0433 https://access.redhat.com/errata/RHSA-2021:0433 This issue has been addressed in the following products: Red Hat Fuse 7.9 Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140 |