A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1885485 | Issue Tracking Patch Vendor Advisory |
| https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files | Patch Third Party Advisory |
| https://issues.redhat.com/browse/WFSSL-51 | Permissions Required Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20201016-0004/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Feb 2024, 21:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* |
19 Oct 2021, 13:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20201016-0004/ - Third Party Advisory | |
| CWE | CWE-401 | |
| CPE | cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
Information
Published : 2020-10-06 14:15
Updated : 2024-02-21 21:08
NVD link : CVE-2020-25644
Mitre link : CVE-2020-25644
CVE.ORG link : CVE-2020-25644
JSON object : View
Products Affected
redhat
- jboss_fuse
- single_sign-on
- wildfly_openssl
- openshift_application_runtimes
- jboss_enterprise_application_platform
- jboss_data_grid
- data_grid
netapp
- service_level_manager
- oncommand_workflow_automation
- oncommand_insight
CWE
CWE-401
Missing Release of Memory after Effective Lifetime