Log in Start free

Vulnerability · Published Apr 2, 2024 · Assigned by redhat

CVE-2024-1300Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Medium 5.4

In plain English

A medium-severity security flaw in io.vertx:vertx-core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.1%top 35.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.vertx:vertx-core4.4.8GHSA-9ph3-v2vh-3qx7
Mavenio.vertx:vertx-core4.5.3GHSA-9ph3-v2vh-3qx7

Affected products (as reported)

VendorProductVersions
io.vertx:vertx-core 4.3.4 – through 4.5.2
Red Hat CEQ 3.2 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Cryostat 2 on RHEL 8 see references
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat MTA-6.2-RHEL-9 see references
Red Hat Red Hat AMQ Streams 2.7.0 see references
Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 see references
Red Hat Red Hat build of Quarkus 3.2.11.Final see references
Red Hat RHINT Service Registry 2.5.11 GA see references
Red Hat A-MQ Clients 2 see references
Red Hat OpenShift Serverless see references
Red Hat Red Hat AMQ Broker 7 see references
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 see references
Red Hat Red Hat build of Apache Camel for Spring Boot 3 see references
Red Hat Red Hat Build of Keycloak see references
Red Hat Red Hat build of OptaPlanner 8 see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat Integration Camel K 1 see references
Red Hat Red Hat Integration Camel Quarkus 2 see references
Red Hat Red Hat JBoss Data Grid 7 see references

Weakness: CWE-772 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References