CVE-2024-1300 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
Problem types: cwe_id: CWE-772
description: Missing Release of Resource after Effective Lifetime
Affected products: default_status: unaffected
vendor: Red Hat
product: CEQ 3.2
cpes: cpe:/a:redhat:camel_quarkus:3
default_status: unaffected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Cryostat 2 on RHEL 8
cpes: cpe:/a:redhat:cryostat:2::el8
default_status: affected
vendor: Red Hat
product: Migration Toolkit for Runtimes 1 on RHEL 8
cpes: cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
default_status: affected
vendor: Red Hat
product: Migration Toolkit for Runtimes 1 on RHEL 8
cpes: cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
default_status: affected
vendor: Red Hat
product: Migration Toolkit for Runtimes 1 on RHEL 8
cpes: cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
default_status: affected
vendor: Red Hat
product: Migration Toolkit for Runtimes 1 on RHEL 8
cpes: cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8
default_status: affected
vendor: Red Hat
product: MTA-6.2-RHEL-9
cpes: cpe:/a:redhat:migration_toolkit_applications:6.2::el9
cpe:/a:redhat:migration_toolkit_applications:6.2::el8
default_status: affected
vendor: Red Hat
product: Red Hat AMQ Streams 2.7.0
cpes: cpe:/a:redhat:amq_streams:2
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
cpes: cpe:/a:redhat:apache_camel_spring_boot:4.4::el6
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Quarkus 3.2.11.Final
cpes: cpe:/a:redhat:quarkus:3.2::el8
default_status: affected
vendor: Red Hat
product: RHINT Service Registry 2.5.11 GA
cpes: cpe:/a:redhat:service_registry:2.5
default_status: unaffected
vendor: Red Hat
product: A-MQ Clients 2
cpes: cpe:/a:redhat:a_mq_clients:2
default_status: unaffected
vendor: Red Hat
product: OpenShift Serverless
cpes: cpe:/a:redhat:serverless:1
default_status: unaffected
vendor: Red Hat
product: Red Hat AMQ Broker 7
cpes: cpe:/a:redhat:amq_broker:7
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apache Camel for Spring Boot 3
cpes: cpe:/a:redhat:camel_spring_boot:3
default_status: affected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
cpes: cpe:/a:redhat:optaplanner:::el6
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus
cpes: cpe:/a:redhat:quarkus:2
default_status: affected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Integration Camel K 1
cpes: cpe:/a:redhat:integration:1
default_status: affected
vendor: Red Hat
product: Red Hat Integration Camel Quarkus 2
cpes: cpe:/a:redhat:camel_quarkus:2
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
cpes: cpe:/a:redhat:jboss_data_grid:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2024-04-02T07:33:05.215Z