Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1530457 - (CVE-2018-1041) CVE-2018-1041 jboss-remoting: High CPU Denial of Service
CVE-2018-1041 jboss-remoting: High CPU Denial of Service
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20180205,repor...
: Security
Depends On: 1530459
Blocks: 1530445 1537472
  Show dependency tree / graph
 
Reported: 2018-01-03 00:40 EST by Jason Shepherd
Modified: 2018-10-19 17:45 EDT (History)
28 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10.Final-redhat-1, reads from an empty buffer. An attacker could use this flaw to cause denial of service via high CPU caused by an infinite loop.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:0268 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.19 security update 2018-02-05 14:05:56 EST
Red Hat Product Errata RHSA-2018:0269 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.19 security update 2018-02-05 17:11:04 EST
Red Hat Product Errata RHSA-2018:0270 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.19 security update 2018-02-05 10:44:31 EST
Red Hat Product Errata RHSA-2018:0271 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.4.19 security update 2018-02-05 14:08:06 EST
Red Hat Product Errata RHSA-2018:0275 normal SHIPPED_LIVE Important: jboss-ec2-eap security, bug fix, and enhancement update 2018-02-05 14:24:53 EST

  None (edit)
Description Jason Shepherd 2018-01-03 00:40:50 EST 
A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10.Final-redhat-1, reads from an empty buffer. An attacker could use this flaw to cause denial of service via high CPU caused by an infinite loop.
Comment 4 Jason Shepherd 2018-01-03 00:52:17 EST 
By default JBoss EAP 7.x doesn't expose port 4447 as it uses HTTP-REMOTING over port 8080. Reference:

https://access.redhat.com/solutions/2360971
Comment 5 Jason Shepherd 2018-01-03 00:56:21 EST 
I couldn't reproduce this issue on EAP 7.0.8 or 7.1.0 after exposing the 'native' connector as explained in previous comment (#4).
Comment 8 Jason Shepherd 2018-01-08 19:21:30 EST 
Acknowledgements:

(none)
Comment 10 errata-xmlrpc 2018-02-05 05:27:37 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2018:0269 https://access.redhat.com/errata/RHSA-2018:0269
Comment 11 errata-xmlrpc 2018-02-05 05:41:42 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7

Via RHSA-2018:0268 https://access.redhat.com/errata/RHSA-2018:0268
Comment 12 errata-xmlrpc 2018-02-05 05:44:33 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5

Via RHSA-2018:0271 https://access.redhat.com/errata/RHSA-2018:0271
Comment 13 errata-xmlrpc 2018-02-05 05:47:23 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2018:0270 https://access.redhat.com/errata/RHSA-2018:0270
Comment 14 errata-xmlrpc 2018-02-05 09:25:03 EST 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6

Via RHSA-2018:0275 https://access.redhat.com/errata/RHSA-2018:0275
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.