CVE-2017-12174: Uncontrolled Resource Consumption in Artemis and HornetQ
Summary
CVE-2017-12174: Uncontrolled Resource Consumption in Artemis and HornetQ. Affects org.hornetq:hornetq-server versions < 2.4.0.Final. Fixed in 2.4.0.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artemis and HornetQ are messaging systems that provide support for the Java Message Service (JMS) API. They are commonly used in enterprise applications for reliable and scalable messaging. These systems use UDP and JGroups discovery for network communication. However, versions before 2.4.0 are vulnerable to uncontrolled resource consumption when receiving unexpected multicast messages. This can lead to heap memory exhaustion, full garbage collection, or OutOfMemoryError.
Vulnerability Detail
The vulnerability arises from the creation of a large byte array when Artemis and HornetQ receive unexpected multicast messages. This can result in excessive memory usage, potentially leading to system instability or crashes. Attackers can exploit this vulnerability by sending specially crafted multicast messages, causing denial-of-service (DoS) conditions. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
2.4.0.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of Artemis and HornetQ.
Conclusion
The vulnerability in Artemis and HornetQ versions before 2.4.0 can lead to uncontrolled resource consumption and potential denial-of-service (DoS) conditions. It is crucial to upgrade to the fixed versions and apply the recommended fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.hornetq:hornetq-server →
FAQ
Artemis and HornetQ are messaging systems that provide support for the Java Message Service (JMS) API. They are commonly used in enterprise applications for reliable and scalable messaging.
The vulnerability can lead to uncontrolled resource consumption, potentially causing system instability or crashes. Attackers can exploit this vulnerability to create denial-of-service (DoS) conditions.
To fix this vulnerability, upgrade Artemis and HornetQ to version 2.4.0 or later. Update your dependencies and rebuild your applications. Review and update network configurations to prevent unauthorized multicast messages.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the fixed versions of Artemis and HornetQ.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
