Vulnerability · Published Dec 8, 2020 · Assigned by redhat
CVE-2020-27822
Medium 5.9
In plain English
A medium-severity memory leak in wildfly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)1.1%top 33.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.wildfly:wildfly-parent | 21.0.2.Final | GHSA-qx3p-9mmp-4v8h |
| Maven | org.wildfly:wildfly-parent | 22.0.0.Beta1 | GHSA-qx3p-9mmp-4v8h |
Affected products (as reported)
Weakness: CWE-401
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1904060 x_refsource_CONFIRM