medium6.5
CVE-2020-14297
Wildfly EJB Client causes DoS
Impact
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventually unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jboss:jboss-ejb-client | < 4.0.34.Final | 4.0.34.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Amq | Version 2.0 |
| Redhat | Jboss-Ejb-Client | from 1.0.0 before 4.0.34 |
| Redhat | Jboss Enterprise Application Platform Continuous Delivery | All versions |
| Redhat | Jboss Fuse | Version 6.0.0 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Single Sign-On | Version 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297
- https://github.com/advisories/GHSA-qcch-9268-59jw
- https://nvd.nist.gov/vuln/detail/CVE-2020-14297
- https://access.redhat.com/errata/RHSA-2020:3141
- https://access.redhat.com/errata/RHSA-2020:3142
- https://access.redhat.com/errata/RHSA-2020:3143
- https://access.redhat.com/errata/RHSA-2020:3144
- https://access.redhat.com/errata/RHSA-2020:3461
- https://access.redhat.com/errata/RHSA-2020:3462
- https://access.redhat.com/errata/RHSA-2020:3463
- https://access.redhat.com/errata/RHSA-2020:3464
- https://access.redhat.com/errata/RHSA-2020:3501
- https://access.redhat.com/errata/RHSA-2020:3539
- https://access.redhat.com/errata/RHSA-2020:3637
- https://access.redhat.com/errata/RHSA-2020:3638
- https://access.redhat.com/errata/RHSA-2020:3639
- https://access.redhat.com/errata/RHSA-2020:3642
- https://access.redhat.com/errata/RHSA-2020:3817
- https://access.redhat.com/errata/RHSA-2021:3140
- https://access.redhat.com/security/cve/CVE-2020-14297
- https://bugzilla.redhat.com/show_bug.cgi?id=1853595
- https://access.redhat.com/solutions/21906
- https://github.com/wildfly/jboss-ejb-client/commit/e5f8e4b591f1698a53adc7e430584ca2a8fc9f1b
- https://github.com/wildfly/jboss-ejb-client/commits/4.0.34.Final