CVE-2020-27217 Improper Validation of Specified Quantity in Input in Eclipse Hono
Attackers can cause denial of service in Eclipse Hono by sending oversized AMQP messages, leading to out-of-memory exceptions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27217?
CVE-2020-27217 is a high-severity denial of service vulnerability in The Eclipse Foundation Eclipse Hono, published on 13 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.
Weakness: CWE-1284
Which versions are affected by CVE-2020-27217?
2 open source packages ship an affected version, including org.eclipse.hono:hono-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.hono:hono-core Maven | All versions | 1.4.3 |
org.eclipse.hono:hono-core Maven | All versions | 1.4.3 |
Products include Eclipse Hono.
How do I fix CVE-2020-27217?
Upgrade org.eclipse.hono:hono-core to 1.4.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-27217 being exploited?
There is no known exploitation of CVE-2020-27217 in the wild and no public exploit code.
Other vulnerabilities in The Eclipse Foundation Eclipse Hono
Sources
Also known as GHSA-9f52-hpvw-v96w.