CVE-2020-35216: Denial of Service (DoS) in Atomix v3.1.5
Summary
CVE-2020-35216: An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages. Affects io.atomix:atomix versions < 3.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Atomix is a Maven package that provides a distributed coordination framework for building fault-tolerant and scalable applications. It offers features such as distributed data structures, messaging, and consensus algorithms. Atomix v3.1.5 is affected by a vulnerability that can be exploited to cause a denial of service (DoS) attack. This vulnerability allows attackers to send false member down event messages, leading to the disruption of the system's normal operation.
Vulnerability Detail
The vulnerability in Atomix v3.1.5 arises from a lack of proper validation of member down event messages. By sending crafted false messages, an attacker can trick the system into believing that a member has gone down, causing a disruption in the distributed coordination. This can result in a DoS condition, impacting the availability of the system. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a secure version of Atomix.
Conclusion
Atomix v3.1.5 is vulnerable to a DoS attack due to a lack of validation in member down event messages. To mitigate this vulnerability, it is crucial to upgrade to a secure version of Atomix. By doing so, you can protect your system from false member down event messages and ensure the availability of your distributed coordination framework. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.atomix:atomix →
FAQ
This vulnerability can lead to a denial of service (DoS) attack, causing disruption to the normal operation of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the pom.xml file.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.9.
No, there are no known workarounds for this vulnerability. It is crucial to apply the recommended fix by upgrading to a secure version of Atomix.
To fix this vulnerability, you should upgrade to a version of Atomix that includes the necessary security patches. Update your project's Maven configuration to use a version of Atomix that is not affected by this issue.
Related vulnerabilities
Recent vulnerabilities recorded for io.atomix:atomix.
