We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Bugpilot (Bug tracking)

Ok

THREATINT CVE Home CVE Diag Help
PUBLISHED

CVE-2024-1300

Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Reserved:2024-02-07
Published:2024-04-02
Updated:2024-04-18

Description

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.



MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Problem types

Uncontrolled Resource Consumption

Product status

Default status
affected

Default status
unaffected

Default status
affected

1.2-18 before *
unaffected

Default status
affected

1.2-11 before *
unaffected

Default status
affected

1.2-12 before *
unaffected

Default status
affected

1.2-10 before *
unaffected

Default status
affected

4.4.8.redhat-00001 before *
unaffected

Default status
unknown

Default status
unknown

Default status
affected

Default status
unknown

Default status
unknown

Default status
unknown

Default status
unknown

Default status
unknown

Default status
affected

Default status
unknown

Default status
unknown

Default status
unknown

Default status
unknown

Default status
unknown

Default status
unknown

Default status
unknown

Default status
unaffected

Default status
unaffected

Default status
unknown

Default status
unaffected

Default status
unknown

Timeline

2024-02-07:Reported to Red Hat.
2024-02-06:Made public.

References

https://access.redhat.com/errata/RHSA-2024:1662 (RHSA-2024:1662) vendor-advisory

https://access.redhat.com/errata/RHSA-2024:1706 (RHSA-2024:1706) vendor-advisory

https://access.redhat.com/errata/RHSA-2024:1923 (RHSA-2024:1923) vendor-advisory

https://access.redhat.com/security/cve/CVE-2024-1300 vdb-entry

https://bugzilla.redhat.com/show_bug.cgi?id=2263139 (RHBZ#2263139) issue-tracking

https://vertx.io/docs/vertx-core/java/#_server_name_indication_sni.

cve.org CVE-2024-1300

nvd.nist.gov CVE-2024-1300

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-1300