CVE-2022-0853 Information disclosure in jboss-client
Repeated use of UserTransaction in the JBoss client library causes a memory leak, potentially leading to information leakage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0853?
CVE-2022-0853 is a high-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 11 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
Weakness: CWE-401
Which versions are affected by CVE-2022-0853?
It affects 5 products.
Products include Redhat Descision Manager, Redhat Jboss Enterprise Application Platform, Redhat Jboss Enterprise Application Platform Expansion Pack, Redhat Process Automation, Redhat Single Sign-On.
How do I fix CVE-2022-0853?
Apply the vendor's patch.
Is CVE-2022-0853 being exploited?
There is no known exploitation of CVE-2022-0853 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2021-20306 Information disclosure in Business-central
- CVE-2021-3644 wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-f67w-c9w2-5v69.