CVE-2020-14307 Denial of service in wildfly

What is CVE-2020-14307?

CVE-2020-14307 is a medium-severity denial of service vulnerability in Redhat Single Sign-On, published on 24 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.

Weakness: CWE-404

Which versions are affected by CVE-2020-14307?

It affects 5 products.

Products include Redhat Amq, Redhat Jboss Enterprise Application Platform Continuous Delivery, Redhat Jboss Fuse, Redhat Openshift Application Runtimes, Redhat Single Sign-On.

How do I fix CVE-2020-14307?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-14307 being exploited?

There is no known exploitation of CVE-2020-14307 in the wild and no public exploit code.

Other vulnerabilities in Redhat Single Sign-On

• CVE-2015-5182 Cross-site request forgery in n/a High 8.8
• CVE-2022-1278 WildFly vulnerable to Insecure Default Initialization of Resource High 7.5
• CVE-2015-5183 Security feature bypass in n/a High 7.5
• CVE-2015-5184 Misconfiguration in n/a High 7.5
• CVE-2020-14297 Wildfly EJB Client causes DoS Medium 6.5

All Redhat Single Sign-On vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q562-x7c7-5fc9.