CVE-2020-27217: Improper Validation of Specified Quantity in Input in Eclipse Hono
Summary
CVE-2020-27217: Improper Validation of Specified Quantity in Input in Eclipse Hono. Affects org.eclipse.hono:hono-core versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Eclipse Hono is an open-source project that provides a scalable and extensible IoT connectivity framework. It allows devices to send telemetry data and receive commands over various protocols. The AMQP protocol adapter in Eclipse Hono versions 1.3.0 and 1.4.0 is vulnerable to improper validation of the specified quantity in input. This vulnerability can be exploited by a device to send messages larger than the maximum allowed size, potentially causing the adapter to fail with an out of memory exception.
Vulnerability Detail
The AMQP protocol adapter in Eclipse Hono does not properly verify the size of AMQP messages received from devices. Although the AMQP 1.0 protocol prohibits sending messages larger than the maximum allowed size, a handcrafted AMQP 1.0 client can exploit this behavior to send unlimited-sized messages to the adapter. This can lead to the adapter running out of memory and failing. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
1.4.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, the AMQP protocol adapter in Eclipse Hono versions 1.3.0 and 1.4.0 is vulnerable to improper validation of the specified quantity in input. This can be exploited by a device to send messages larger than the maximum allowed size, potentially causing the adapter to fail. It is recommended to upgrade to Eclipse Hono version 1.4.3 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.hono:hono-core →
FAQ
Eclipse Hono is an open-source IoT connectivity framework that allows devices to send telemetry data and receive commands over various protocols.
The AMQP protocol adapter is a component in Eclipse Hono that enables devices to communicate using the AMQP protocol.
This vulnerability affects Eclipse Hono versions 1.3.0 and 1.4.0. It allows devices to send messages larger than the maximum allowed size, potentially causing the adapter to fail with an out of memory exception.
The impact of this vulnerability is that an attacker can exploit it to send unlimited-sized messages to the AMQP protocol adapter, causing it to run out of memory and fail.
Yes, upgrading Eclipse Hono to version 1.4.3 or later fixes this vulnerability.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
