Red Hat JBossEAP: Missing Release of Memory after Effective Lifetime (CVE-2024-3653)

Red Hat JBossEAP: Missing Release of Memory after Effective Lifetime (CVE-2024-3653)

Severity

5

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:P)

Published

07/08/2024

Created

09/20/2024

Added

09/19/2024

Modified

12/20/2024

Description

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Solution(s)

• red-hat-jboss-eap-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-3653
• CVE - 2024-3653
• https://access.redhat.com/security/cve/CVE-2024-3653
• https://bugzilla.redhat.com/show_bug.cgi?id=2274437
• https://access.redhat.com/errata/RHSA-2024:4392
• https://access.redhat.com/errata/RHSA-2024:5143
• https://access.redhat.com/errata/RHSA-2024:5144
• https://access.redhat.com/errata/RHSA-2024:5145
• https://access.redhat.com/errata/RHSA-2024:5147

View more