CVE-2020-35210: Atomix v3.1.5 Raft Session Flooding Denial of Service
Summary
CVE-2020-35210: A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages. Affects io.atomix:atomix versions < 3.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Atomix is a Maven package that provides a distributed coordination framework for building fault-tolerant and scalable applications. It offers a set of high-level abstractions and primitives, including distributed collections, distributed locks, and distributed state machines. Atomix is vulnerable to a denial of service (DoS) attack when using Raft OpenSessionRequest messages. This vulnerability affects versions 0 to 3.1.5 of the Atomix package.
Vulnerability Detail
The vulnerability in Atomix v3.1.5 allows attackers to launch a Raft session flooding attack using Raft OpenSessionRequest messages. By flooding the system with these messages, an attacker can cause a denial of service, rendering the system unresponsive. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The attack can be executed remotely without requiring any user interaction. The impact of this vulnerability includes service disruption, potential data loss, and degradation of system performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the Atomix package to a non-vulnerable version.
Conclusion
Atomix v3.1.5 is vulnerable to a Raft session flooding attack, which can result in a denial of service (DoS) condition. To mitigate this vulnerability, it is crucial to upgrade the Atomix package to a non-vulnerable version, specifically version 3.1.6 or higher. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.atomix:atomix →
FAQ
Atomix is a distributed coordination framework for building fault-tolerant and scalable applications. It provides high-level abstractions and primitives for distributed computing.
A Raft session flooding attack is a type of denial of service (DoS) attack that targets the Raft consensus algorithm. By flooding the system with Raft OpenSessionRequest messages, an attacker can overwhelm the system and render it unresponsive.
This vulnerability can lead to a denial of service (DoS) condition, causing service disruption, potential data loss, and degradation of system performance.
Yes, this vulnerability can be exploited remotely without requiring any user interaction.
This vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for io.atomix:atomix.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
