Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-1300

Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

io.vertx:vertx-core

Default version status: unaffected

  • 4.3.4 to ≤ 4.5.2affected

Red Hat CEQ 3.2

Default version status: unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-7 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-9 to < *unaffected

Red Hat Cryostat 2 on RHEL 8

Default version status: affected

  • 2.4.0-4 to < *unaffected

Red Hat Migration Toolkit for Runtimes 1 on RHEL 8

Default version status: affected

  • 1.2-18 to < *unaffected

Red Hat Migration Toolkit for Runtimes 1 on RHEL 8

Default version status: affected

  • 1.2-11 to < *unaffected

Red Hat Migration Toolkit for Runtimes 1 on RHEL 8

Default version status: affected

  • 1.2-12 to < *unaffected

Red Hat Migration Toolkit for Runtimes 1 on RHEL 8

Default version status: affected

  • 1.2-10 to < *unaffected

Red Hat MTA-6.2-RHEL-9

Default version status: affected

  • 6.2.3-2 to < *unaffected

Red Hat Red Hat AMQ Streams 2.7.0

Default version status: unaffected

Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2

Default version status: unaffected

Red Hat Red Hat build of Quarkus 3.2.11.Final

Default version status: affected

  • 4.4.8.redhat-00001 to < *unaffected

Red Hat RHINT Service Registry 2.5.11 GA

Default version status: unaffected

Red Hat A-MQ Clients 2

Default version status: unaffected

Red Hat OpenShift Serverless

Default version status: unaffected

Red Hat Red Hat AMQ Broker 7

Default version status: unaffected

Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

Default version status: affected

Red Hat Red Hat build of Apache Camel for Spring Boot 3

Default version status: affected

Red Hat Red Hat Build of Keycloak

Default version status: affected

Red Hat Red Hat build of OptaPlanner 8

Default version status: affected

Red Hat Red Hat build of Quarkus

Default version status: affected

Red Hat Red Hat Data Grid 8

Default version status: unaffected

Red Hat Red Hat Fuse 7

Default version status: unaffected

Red Hat Red Hat Integration Camel K 1

Default version status: affected

Red Hat Red Hat Integration Camel Quarkus 2

Default version status: affected

Red Hat Red Hat JBoss Data Grid 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: unaffected

Red Hat Red Hat Process Automation 7

Default version status: affected

References