Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.jboss.remoting:jboss-remoting

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    Uncontrolled Resource Consumption in jboss-remoting

    CVE-2020-35510 · GHSA-p6j8-hgv5-m35g

    Affected
    • Maven org.jboss.remoting:jboss-remoting <= 5.0.19.Final
    Fixed in
    5.0.20.Final· Vendor fix available
    Issue
    A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

    Recommended action: Upgrade to 5.0.20.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →