Uploaded image for project: 'JBoss Remoting (3+)'
  1. JBoss Remoting (3+)
  2. REM3-379

CVE-2020-35510 Threads hold up forever in the EJB server by suppressing the ack from an EJB client

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • 5.1.0.Final, 5.0.22.Final
    • None
    • None

    Description

      A flaw was found in JBoss Remoting. When a malicious attacker could cause threads holding up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ack messages, or just tamper with jboss-remoting code, deleting the lines that send the ack message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

      CVE Info: https://access.redhat.com/security/cve/cve-2020-35510

      Attachments

        Issue Links

          causes

          Bug - A problem that impairs or prevents the functions of the product. REM3-387 IOException with message ack timeout expired before timeout has elapsed

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved
          is incorporated by

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. JBEAP-21961 [GSS](7.4.z) Upgrade remoting from 5.0.20.SP1-redhat-00001 to 5.0.23.SP1-redhat-00001

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. WFCORE-5423 Upgrade remoting from 5.0.21.Final to 5.0.23.Final (fixes CVE-2020-35510)

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed
          is related to

          Enhancement - An enhancement to or refactoring of existing functionality that is not configurable by an end user (typically a change made by an internal team that affects users) REM3-388 Move ACK_TIMEOUT to nanoseconds

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved
          links to

          Web Link JBoss Remoting Github Issue #271

          Activity

            People

              flaviarnn Flavia Rainone
              flaviarnn Flavia Rainone
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: