A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability. Upstream issue: https://issues.redhat.com/browse/WFSSL-51 Upstream patch: https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files
Although Red Hat Fuse 7 distributes vulnerable wildfly-openssl artifacts, it does not use them and nowhere registers it as the SSL provider, for this reason the impact to Fuse is Low.
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2020:4257 https://access.redhat.com/errata/RHSA-2020:4257
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:4256 https://access.redhat.com/errata/RHSA-2020:4256
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25644
This issue has been addressed in the following products: EAP 7.3.3 Via RHSA-2020:4923 https://access.redhat.com/errata/RHSA-2020:4923
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:4922 https://access.redhat.com/errata/RHSA-2020:4922
This issue has been addressed in the following products: Red Hat Single Sign-On 7.4.3 one-off Via RHSA-2020:4978 https://access.redhat.com/errata/RHSA-2020:4978
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2020:5344 https://access.redhat.com/errata/RHSA-2020:5344
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 Via RHSA-2020:5340 https://access.redhat.com/errata/RHSA-2020:5340
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 Via RHSA-2020:5341 https://access.redhat.com/errata/RHSA-2020:5341
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 Via RHSA-2020:5342 https://access.redhat.com/errata/RHSA-2020:5342
This issue has been addressed in the following products: Red Hat Data Grid 7.3.8 Via RHSA-2020:5410 https://access.redhat.com/errata/RHSA-2020:5410
Mitigation: There is currently no known mitigation for this issue.
This issue has been addressed in the following products: Red Hat Data Grid 8.1.1 Via RHSA-2021:0433 https://access.redhat.com/errata/RHSA-2021:0433
This issue has been addressed in the following products: Red Hat Fuse 7.9 Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140