CVE-2020-14384 Denial of service in JBossWeb

High 7.5 Published 9 Sep 2020 Updated 4 Aug 2024

Attackers can cause a denial of service in JBossWeb by sending multiple WebSocket frames with invalid payload lengths, impacting system availability.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-14384?

CVE-2020-14384 is a high-severity denial of service vulnerability in Redhat Jboss Enterprise Application Platform, published on 9 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame. The highest threat from this vulnerability is to system availability.

Weakness: CWE-400

Which versions are affected by CVE-2020-14384?

It affects 2 products.

Linux distribution packages (3)

`jbossweb` Red Hat:jboss_enterprise_application_platform:6::el5	All versions	`0:7.5.31-3.Final_redhat_3.1.ep6.el5`
`jbossweb` Red Hat:jboss_enterprise_application_platform:6::el6	All versions	`0:7.5.31-3.Final_redhat_3.1.ep6.el6`
`jbossweb` Red Hat:jboss_enterprise_application_platform:6::el7	All versions	`0:7.5.31-3.Final_redhat_3.1.ep6.el7`

Products include Redhat Jboss Enterprise Application Platform, Redhat Jbossweb.

How do I fix CVE-2020-14384?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-14384 being exploited?

There is no known exploitation of CVE-2020-14384 in the wild and no public exploit code.

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

Also known as GHSA-8793-frgg-7jvv, RHSA-2020:3730.