CVE-2024-1023

{"id": "CVE-2024-1023", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-03-27T08:15:38.140", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1662", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1706", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:2088", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1023", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260840", "source": "secalert@redhat.com"}, {"url": "https://github.com/eclipse-vertx/vert.x/issues/5078", "source": "secalert@redhat.com"}, {"url": "https://github.com/eclipse-vertx/vert.x/pull/5080", "source": "secalert@redhat.com"}, {"url": "https://github.com/eclipse-vertx/vert.x/pull/5082", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak."}, {"lang": "es", "value": "Una vulnerabilidad en el kit de herramientas Eclipse Vert.x provoca una p\u00e9rdida de memoria debido al uso de estructuras de datos Netty FastThreadLocal. Espec\u00edficamente, cuando el cliente HTTP Vert.x establece conexiones con diferentes hosts, lo que desencadena la p\u00e9rdida de memoria. La filtraci\u00f3n se puede acelerar con un conocimiento \u00edntimo del tiempo de ejecuci\u00f3n, lo que permite a un atacante explotar esta vulnerabilidad. Por ejemplo, un servidor que acepte direcciones de Internet arbitrarias podr\u00eda servir como vector de ataque al conectarse a estas direcciones, acelerando as\u00ed la p\u00e9rdida de memoria."}], "lastModified": "2024-04-29T07:15:06.233", "sourceIdentifier": "secalert@redhat.com"}