SB20200903130 - Multiple vulnerabilities in JBoss Data Grid 8.1

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20200903130

SB20200903130 - Multiple vulnerabilities in JBoss Data Grid 8.1

Published: September 3, 2020 Updated: April 24, 2025

Security Bulletin ID SB20200903130
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2020-9488)

The vulnerability allows a remote attacker to perform man-in-the-middle attack.

The vulnerability exists due to the Apache Log4j SMTP appender does not validate SSL certificates. A remote attacker can perform a MitM attack, intercept and decrypt network traffic.


2) Resource exhaustion (CVE-ID: CVE-2020-11612)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within ZlibDecoders in Netty while decoding a ZlibEncoded byte stream. A remote attacker can trigger resource exhaustion by passing an overly large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.


Remediation

Install update from vendor's website.

References