CVE-2020-14297: Wildfly EJB Client causes DoS
Summary
CVE-2020-14297: Wildfly EJB Client causes DoS. Affects org.jboss:jboss-ejb-client versions < 4.0.34.Final. Fixed in 4.0.34.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Wildfly EJB Client is a component of Red Hat JBoss EAP 7, which is an open-source Java EE-based application server. It provides remote access to Enterprise JavaBeans (EJB) components deployed on a Wildfly server. The EJB Client allows applications to invoke methods on EJB components running on a remote server. It is widely used in enterprise environments for distributed application development and deployment.
Vulnerability Detail
A flaw has been discovered in the Wildfly EJB Client as shipped with Red Hat JBoss EAP 7. This vulnerability allows an attacker to cause a denial of service (DoS) attack by exploiting a specific issue related to EJB transaction objects. Over time, these objects can accumulate and cause services to slow down and eventually become unavailable. By taking advantage of this flaw, an attacker can disrupt the normal functioning of services and make them unavailable to legitimate users.
How To Fix
Minimum fixed version
4.0.34.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the patch or update the affected package to a secure version.
Conclusion
In conclusion, the Wildfly EJB Client vulnerability (CVE-2020-14297) can lead to a denial of service (DoS) attack by causing services to slow down and become unavailable. It is crucial to update the affected package to a secure version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss:jboss-ejb-client →
FAQ
This vulnerability can cause a denial of service (DoS) attack, making the affected services slow down and eventually become unavailable.
Users of Red Hat JBoss EAP 7 with the Wildfly EJB Client component are affected by this vulnerability.
No, authentication is not required to exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
No, this vulnerability requires a patch or update to the affected package to be fully mitigated.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jboss:jboss-ejb-client.
