CVE-2020-27822 Wildfly has a memory leak vulnerability

What is CVE-2020-27822?

CVE-2020-27822 is a medium-severity denial of service vulnerability in wildfly, published on 8 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.

Weakness: CWE-401

Which versions are affected by CVE-2020-27822?

5 open source packages ship an affected version, including org.wildfly:wildfly-parent and wildfly. It affects 1 product.

Products include Redhat Wildfly.

How do I fix CVE-2020-27822?

Upgrade org.wildfly:wildfly-parent to a fixed version for your release line: 21.0.2.Final or 22.0.0.Beta1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-27822 being exploited?

There is no known exploitation of CVE-2020-27822 in the wild and no public exploit code.

Other vulnerabilities in wildfly

• CVE-2018-10683 Auth bypass in n/a Critical 9.8
• CVE-2020-10740 Wildfly Unsafe Deserialization Vulnerability Medium 6.6
• CVE-2020-1719 Privilege Context Switching Error in wildlfy Medium 5.4
• CVE-2020-25640 Wildfly logs plaintext passwords Medium 5.3
• CVE-2018-14627 Security feature bypass in JBoss/WildFly Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-wildfly-2020-27822, GHSA-qx3p-9mmp-4v8h.