CVE-2017-12174

Published: Mar 7, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.

Affected (5)

Products: Apache: Activemq Artemis · Redhat: Hornetq, Jboss Enterprise Application Platform

1 product

Activemq Artemis

2 products

Jboss Enterprise Application Platform

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Activemq Artemis	Before 2.4.0
Redhat Hornetq	Before 2.4.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.1.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 7.0

Configuration D

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 6.4.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 6.0

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (24)

https://access.redhat.com/errata/RHSA-2018:0268

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0269

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0270

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0271

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0275

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0478

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0479

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0480

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0481

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12174

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2018:0268

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0269

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0270

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0271

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0275

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0478

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0479

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0480

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:0481

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12174

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afccabbcd9847a82088%40%3Ccommits.activemq.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.