CVE-2020-14297

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-14297
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
History

29 Dec 2023, 17:55

Type Values Removed Values Added
First Time Redhat jboss-ejb-client
CPE cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:*

12 Feb 2023, 23:39

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3142', 'name': 'https://access.redhat.com/errata/RHSA-2020:3142', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2020-14297', 'name': 'https://access.redhat.com/security/cve/CVE-2020-14297', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1853595', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1853595', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3463', 'name': 'https://access.redhat.com/errata/RHSA-2020:3463', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3638', 'name': 'https://access.redhat.com/errata/RHSA-2020:3638', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3539', 'name': 'https://access.redhat.com/errata/RHSA-2020:3539', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3817', 'name': 'https://access.redhat.com/errata/RHSA-2020:3817', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3464', 'name': 'https://access.redhat.com/errata/RHSA-2020:3464', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3144', 'name': 'https://access.redhat.com/errata/RHSA-2020:3144', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3143', 'name': 'https://access.redhat.com/errata/RHSA-2020:3143', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3637', 'name': 'https://access.redhat.com/errata/RHSA-2020:3637', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3461', 'name': 'https://access.redhat.com/errata/RHSA-2020:3461', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3501', 'name': 'https://access.redhat.com/errata/RHSA-2020:3501', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3462', 'name': 'https://access.redhat.com/errata/RHSA-2020:3462', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3642', 'name': 'https://access.redhat.com/errata/RHSA-2020:3642', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2021:3140', 'name': 'https://access.redhat.com/errata/RHSA-2021:3140', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3141', 'name': 'https://access.redhat.com/errata/RHSA-2020:3141', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:3639', 'name': 'https://access.redhat.com/errata/RHSA-2020:3639', 'tags': [], 'refsource': 'MISC'}
Summary A flaw was found in Wildfly's EJB Client, where the accumulation of specific EJB transaction objects over time can cause services to slow down and eventually become unavailable. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is to system availability. A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.

02 Feb 2023, 21:19

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3142 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2020-14297 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1853595 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3463 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3638 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3539 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3817 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3464 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3144 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3143 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3637 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3461 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3501 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3462 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3642 -
  • (MISC) https://access.redhat.com/errata/RHSA-2021:3140 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3141 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:3639 -
Summary A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable. A flaw was found in Wildfly's EJB Client, where the accumulation of specific EJB transaction objects over time can cause services to slow down and eventually become unavailable. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is to system availability.
Information

Published : 2020-07-24 16:15

Updated : 2023-12-29 17:55

NVD link : CVE-2020-14297

Mitre link : CVE-2020-14297

CVE.ORG link : CVE-2020-14297

JSON object : View

Products Affected

redhat

  • jboss_fuse
  • amq
  • single_sign-on
  • openshift_application_runtimes
  • jboss-ejb-client
  • jboss_enterprise_application_platform_continuous_delivery
CWE
CWE-400

Uncontrolled Resource Consumption