Vulnerability · Published Jun 2, 2021 · Assigned by redhat

CVE-2020-35510

Medium 5.9

In plain English

A medium-severity uncontrolled resource consumption in jboss-remoting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium

Exploit odds (30 days)1.1%top 34.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jboss.remoting:jboss-remoting	5.0.20.Final	GHSA-p6j8-hgv5-m35g

Affected products (as reported)

Vendor	Product	Versions
n/a	jboss-remoting	jboss-remoting 5.0.20.SP1-redhat-00001

Weakness: CWE-400

References

https://bugzilla.redhat.com/show_bug.cgi?id=1905796 x_refsource_MISC