Vulnerability · Published Oct 6, 2020 · Assigned by redhat
CVE-2020-25644
High 7.5
In plain English
A high-severity memory leak in wildfly-openssl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.4%top 16.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.wildfly.openssl:wildfly-openssl-natives-parent | 1.1.3.Final | GHSA-hxj4-885f-grgp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | wildfly-openssl | before wildfly-openssl 1.1.3.Final |
Weakness: CWE-401