CVE-2020-25644 Wildfly-OpenSSL memory leak flaw

High 7.5 Published 6 Oct 2020 Updated 4 Aug 2024

An attacker can trigger a memory leak in WildFly OpenSSL during session removal, causing out-of-memory errors and denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-25644?

CVE-2020-25644 is a high-severity denial of service vulnerability in Netapp Oncommand Insight, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

Weakness: CWE-401

Which versions are affected by CVE-2020-25644?

2 open source packages ship an affected version, including org.wildfly.openssl:wildfly-openssl-natives-parent. It affects 10 products.

Package	Affected	Fixed in
`org.wildfly.openssl:wildfly-openssl-natives-parent` Maven	All versions	`1.1.3.Final`
`org.wildfly.openssl:wildfly-openssl-natives-parent` Maven	All versions	`1.1.3.Final`

Linux distribution packages (12)

`eap7-wildfly-openssl-linux-x86_64` Red Hat:jboss_enterprise_application_platform:7.3::el6	All versions	`0:1.0.11-1.Final_redhat_00001.1.el6eap`
`eap7-wildfly-openssl-linux-x86_64` Red Hat:jboss_enterprise_application_platform:7.3::el6	All versions	`0:1.0.12-1.Final_redhat_00001.1.el6eap`
`eap7-wildfly-openssl-linux-x86_64-debuginfo` Red Hat:jboss_enterprise_application_platform:7.3::el6	All versions	`0:1.0.11-1.Final_redhat_00001.1.el6eap`
`eap7-wildfly-openssl-linux-x86_64-debuginfo` Red Hat:jboss_enterprise_application_platform:7.3::el6	All versions	`0:1.0.12-1.Final_redhat_00001.1.el6eap`
`eap7-wildfly-openssl-linux-x86_64` Red Hat:jboss_enterprise_application_platform:7.3::el7	All versions	`0:1.0.11-1.Final_redhat_00001.1.el7eap`
`eap7-wildfly-openssl-linux-x86_64` Red Hat:jboss_enterprise_application_platform:7.3::el7	All versions	`0:1.0.12-1.Final_redhat_00001.1.el7eap`
`eap7-wildfly-openssl-linux-x86_64-debuginfo` Red Hat:jboss_enterprise_application_platform:7.3::el7	All versions	`0:1.0.11-1.Final_redhat_00001.1.el7eap`
`eap7-wildfly-openssl-linux-x86_64-debuginfo` Red Hat:jboss_enterprise_application_platform:7.3::el7	All versions	`0:1.0.12-1.Final_redhat_00001.1.el7eap`
`eap7-wildfly-openssl-linux-x86_64` Red Hat:jboss_enterprise_application_platform:7.3::el8	All versions	`0:1.0.11-1.Final_redhat_00001.1.el8eap`
`eap7-wildfly-openssl-linux-x86_64` Red Hat:jboss_enterprise_application_platform:7.3::el8	All versions	`0:1.0.12-1.Final_redhat_00001.1.el8eap`
`eap7-wildfly-openssl-linux-x86_64-debuginfo` Red Hat:jboss_enterprise_application_platform:7.3::el8	All versions	`0:1.0.11-1.Final_redhat_00001.1.el8eap`
`eap7-wildfly-openssl-linux-x86_64-debuginfo` Red Hat:jboss_enterprise_application_platform:7.3::el8	All versions	`0:1.0.12-1.Final_redhat_00001.1.el8eap`

Products include Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Netapp Service Level Manager, Redhat Data Grid, Redhat Jboss Data Grid, Redhat Jboss Enterprise Application Platform and 4 more.

How do I fix CVE-2020-25644?

Upgrade org.wildfly.openssl:wildfly-openssl-natives-parent to 1.1.3.Final or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-25644 being exploited?

There is no known exploitation of CVE-2020-25644 in the wild and no public exploit code.

All Netapp Oncommand Insight vulnerabilities

Sources

Also known as GHSA-hxj4-885f-grgp, RHSA-2020:4256, RHSA-2020:4922.