CVE-2020-35510: Uncontrolled Resource Consumption in jboss-remoting
Summary
CVE-2020-35510: Uncontrolled Resource Consumption in jboss-remoting. Affects org.jboss.remoting:jboss-remoting versions < 5.0.20.Final. Fixed in 5.0.20.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jboss-remoting package is a component of the JBoss Application Server that provides support for remote method invocation (RMI) and remote procedure call (RPC) protocols. It allows clients to invoke methods on server-side components and facilitates communication between distributed applications. This vulnerability affects versions before 5.0.20.SP1-redhat-00001.
Vulnerability Detail
A flaw was discovered in jboss-remoting that could be exploited by a malicious attacker to cause threads to hang indefinitely in the EJB server. By sending a sequence of bytes that mimic a successful EJB client request but omitting the ACK messages, or by tampering with the jboss-remoting code to remove the ACK message sending functionality, an attacker can trigger a denial of service (DoS) condition. The primary impact of this vulnerability is a disruption of system availability.
How To Fix
Minimum fixed version
5.0.20.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the recommended fix by upgrading to the patched version of the jboss-remoting package.
Conclusion
The vulnerability in jboss-remoting can be exploited to cause a denial of service (DoS) condition by hanging threads in the EJB server. To mitigate this risk, it is crucial to upgrade to version 5.0.20.SP1-redhat-00001 or later of the jboss-remoting package. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jboss.remoting:jboss-remoting →
FAQ
JBoss Remoting is a component of the JBoss Application Server that enables remote method invocation and remote procedure call protocols for distributed applications.
The vulnerability allows an attacker to cause threads to hang indefinitely in the EJB server, resulting in a denial of service (DoS) condition and a disruption of system availability.
To fix this vulnerability, it is recommended to upgrade to version 5.0.20.SP1-redhat-00001 or later of the jboss-remoting package.
No, there is no known workaround for this vulnerability. It is advised to apply the recommended fix by upgrading to the patched version of the jboss-remoting package.
For more information about this vulnerability, you can refer to the CVE-2020-35510 advisory or contact the vendor for assistance.
