Bug 2136188 (CVE-2022-25897)

Summary:	CVE-2022-25897 sdk-server: Denial of Service
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, balejosg, chazlett, fmongiar, gmalinko, janstey, jnethert, jochrist, jpavlik, jpoth, jwon, pantinor, pdelbell, peholase, pjindal, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	sdk-server 0.6.8	Doc Type:	---
Doc Text:	A flaw was found in the Eclipse Milo SDK Server. This flaw allows an attacker to consume the application memory, leading to a denial of service by sending specific requests.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-10 21:03:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2125449

Description Patrick Del Bello 2022-10-19 14:37:44 UTC

The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

https://github.com/eclipse/milo/issues/1030
https://github.com/eclipse/milo/commit/4534381760d7d9f0bf00cbf6a8449bb0d13c6ce5
https://security.snyk.io/vuln/SNYK-JAVA-ORGECLIPSEMILO-2990191
https://github.com/eclipse/milo/pull/1031

Comment 2 errata-xmlrpc 2022-12-08 13:25:47 UTC

This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.18.3

Via RHSA-2022:8902 https://access.redhat.com/errata/RHSA-2022:8902

Comment 3 Product Security DevOps Team 2022-12-10 21:03:18 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-25897