« Volver al listado

CVE-2020-35510

Estado: ModificadaMedia (5.9)—

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Jboss-remoting

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-35510",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "jboss-remoting",
          "versions": [
            {
              "status": "affected",
              "version": "jboss-remoting 5.0.20.SP1-redhat-00001"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-02T14:15:09.393",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1905796",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1905796",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado un fallo en jboss-remoting en versiones anteriores a 5.0.20.SP1-redhat-00001. Un atacante malicioso podría causar que los hilos (subprocesos) se quedaran detenidos para siempre en el servidor EJB al escribir una secuencia de bytes correspondientes a los mensajes esperados de una petición de cliente EJB con éxito, pero omitiendo los mensajes ACK, o simplemente manipulando el código de jboss-remoting, borrando las líneas que envían el mensaje ACK del código del cliente EJB, resultando en una Denegación de Servicio. La mayor amenaza de esta vulnerabilidad es la disponibilidad del sistema"
    }
  ],
  "lastModified": "2026-06-17T03:13:50.430",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jboss-remoting:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62C98CF3-35A8-42CA-974F-C6232DA0BD5D",
              "versionEndExcluding": "5.0.20"
            },
            {
              "criteria": "cpe:2.3:a:redhat:jboss-remoting:5.0.20:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "415F273E-9CBD-4266-8D2D-02C21A753C8A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}