CVE-2020-25644

Description

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 2.37%• Percentile: 83%

Techniques & Countermeasures

• CWE-401•Missing Release of Memory after Effective Lifetime

  The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Systems

• org.wildfly.openssl•wildfly-openssl-natives-parent

  < 1.1.3.Final

• netapp•oncommand_insight

  na

• netapp•oncommand_workflow_automation

  na

• netapp•service_level_manager

  na

• redhat•data_grid

  8.0

• redhat•jboss_data_grid

  7.0.0

• redhat•jboss_enterprise_application_platform

  7.0.0

• redhat•jboss_fuse

  7.0.0

• redhat•openshift_application_runtimes

  na

• redhat•single_sign-on

  7.0

• redhat•wildfly_openssl

  < 1.1.3

• redhat•eap7-wildfly-openssl-linux-x86_64

  < 0:1.0.11-1.Final_redhat_00001.1.el6eap | < 0:1.0.11-1.Final_redhat_00001.1.el7eap | < 0:1.0.11-1.Final_redhat_00001.1.el8eap | < 0:1.0.12-1.Final_redhat_00001.1.el6eap | < 0:1.0.12-1.Final_redhat_00001.1.el7eap | < 0:1.0.12-1.Final_redhat_00001.1.el8eap

• redhat•eap7-wildfly-openssl-linux-x86_64-debuginfo

  < 0:1.0.11-1.Final_redhat_00001.1.el6eap | < 0:1.0.11-1.Final_redhat_00001.1.el7eap | < 0:1.0.11-1.Final_redhat_00001.1.el8eap | < 0:1.0.12-1.Final_redhat_00001.1.el6eap | < 0:1.0.12-1.Final_redhat_00001.1.el7eap | < 0:1.0.12-1.Final_redhat_00001.1.el8eap

References (18)

• https://issues.redhat.com/browse/WFSSL-51
• https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files
• https://bugzilla.redhat.com/show_bug.cgi?id=1885485
• https://security.netapp.com/advisory/ntap-20201016-0004/
• https://nvd.nist.gov/vuln/detail/CVE-2020-25644
• https://github.com/wildfly-security/wildfly-openssl-natives/pull/4
• https://github.com/wildfly-security/wildfly-openssl-natives/commit/7c26514676f3fb0dee0bcaa7d4680f982372950f
• https://github.com/wildfly-security/wildfly-openssl-natives
• https://security.netapp.com/advisory/ntap-20201016-0004
• https://access.redhat.com/errata/RHSA-2020:4256
• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
• https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
• https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4256.json
• https://access.redhat.com/security/cve/CVE-2020-25644
• https://www.cve.org/CVERecord?id=CVE-2020-25644
• https://access.redhat.com/errata/RHSA-2020:4922
• https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4922.json