Allocation of Resources Without Limits or Throttling in Wildfly Core - CVE-2024-4029

Vulnerability identifier: #VU89919

CSH Severity: Low

CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4029

CWE-ID: CWE-770

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to the lack of limitation of sockets for the management interface. A local administrator can cause a denial of service condition on the target system.

Wildfly Core
JBoss Enterprise Application Platform
eap8-asyncutil (Red Hat package)
eap8-hppc (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap8-cryptacular (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap8-aesh-extensions (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap8-aws-java-sdk (Red Hat package)
eap7-jsoup (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap8-artemis-native (Red Hat package)
eap8-activemq-artemis-native (Red Hat package)
eap8-artemis-wildfly-integration (Red Hat package)
eap8-resteasy-extensions (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-fastinfoset (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-aesh-readline (Red Hat package)
eap8-pem-keystore (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-log4j (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package)
eap8-resteasy-spring (Red Hat package)
eap8-saaj-impl (Red Hat package)
eap8-apache-commons-collections (Red Hat package)
eap7-hal-console (Red Hat package)
eap8-jboss-logging (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-jctools (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap8-jgroups (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap8-narayana (Red Hat package)
eap7-hibernate-validator (Red Hat package)
eap8-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-shibboleth-java-support (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-objectweb-asm (Red Hat package)
eap8-nimbus-jose-jwt (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)

Install updates from vendor's website.

Wildfly Core - update to 24.0.1
JBoss Enterprise Application Platform - addressed in versions 7.4.19, 8.0.4
eap8-asyncutil (Red Hat package) - addressed in versions 0.1.0-2.redhat_00010.1.el8eap, 0.1.0-2.redhat_00010.1.el9eap
eap8-hppc (Red Hat package) - addressed in versions 0.8.1-2.redhat_00001.1.el8eap, 0.8.1-2.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-cryptacular (Red Hat package) - addressed in versions 1.2.5-2.redhat_00001.1.el8eap, 1.2.5-2.redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.18-1.Final_redhat_00001.1.el7eap, 1.5.18-1.Final_redhat_00001.1.el8eap, 1.5.18-1.Final_redhat_00001.1.el9eap
eap8-aesh-extensions (Red Hat package) - addressed in versions 1.8.0-2.redhat_00001.1.el8eap, 1.8.0-2.redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-39.Final_redhat_00039.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el8eap, 1.10.0-39.Final_redhat_00039.1.el9eap
eap8-aws-java-sdk (Red Hat package) - addressed in versions 1.12.284-2.redhat_00002.1.el8eap, 1.12.284-2.redhat_00002.1.el9eap
eap7-jsoup (Red Hat package) - addressed in versions 1.15.4-1.redhat_00003.1.el7eap, 1.15.4-1.redhat_00003.1.el8eap, 1.15.4-1.redhat_00003.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.16.1-2.redhat_00007.1.el8eap, 1.16.1-2.redhat_00007.1.el9eap
eap8-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-activemq-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-artemis-wildfly-integration (Red Hat package) - addressed in versions 2.0.1-1.redhat_00002.1.el8eap, 2.0.1-1.redhat_00002.1.el9eap
eap8-resteasy-extensions (Red Hat package) - addressed in versions 2.0.1-3.Final_redhat_00001.1.el8eap, 2.0.1-3.Final_redhat_00001.1.el9eap
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.el8eap, 2.0.15-1.Final_redhat_00001.1.el9eap
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-1.redhat_00001.1.el8eap, 2.0.16-1.redhat_00001.1.el9eap
eap8-fastinfoset (Red Hat package) - addressed in versions 2.1.0-4.redhat_00001.1.el8eap, 2.1.0-4.redhat_00001.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.2.0-1.redhat_00001.1.el8eap, 2.2.0-1.redhat_00001.1.el9eap
eap8-aesh-readline (Red Hat package) - addressed in versions 2.2.0-2.redhat_00001.1.el8eap, 2.2.0-2.redhat_00001.1.el9eap
eap8-pem-keystore (Red Hat package) - addressed in versions 2.3.0-1.redhat_00001.1.el8eap, 2.3.0-1.redhat_00001.1.el9eap
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-37.redhat_00015.1.el7eap, 2.7.1-37.redhat_00015.1.el8eap, 2.7.1-37.redhat_00015.1.el9eap
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.15.1-1.redhat_00001.1.el8eap, 2.15.1-1.redhat_00001.1.el9eap
eap8-log4j (Red Hat package) - addressed in versions 2.22.1-1.redhat_00002.1.el8eap, 2.22.1-1.redhat_00002.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.33.0-1.redhat_00015.1.el8eap, 2.33.0-1.redhat_00015.1.el9eap
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package) - addressed in versions 3.0.1-1.redhat_00001.1.el8eap, 3.0.1-1.redhat_00001.1.el9eap
eap8-resteasy-spring (Red Hat package) - addressed in versions 3.0.1-2.Final_redhat_00001.1.el8eap, 3.0.1-2.Final_redhat_00001.1.el9eap
eap8-saaj-impl (Red Hat package) - addressed in versions 3.0.4-1.redhat_00001.1.el8eap, 3.0.4-1.redhat_00001.1.el9eap
eap8-apache-commons-collections (Red Hat package) - addressed in versions 3.2.2-28.redhat_2.1.el8eap, 3.2.2-28.redhat_2.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.24-1.Final_redhat_00001.1.el7eap, 3.3.24-1.Final_redhat_00001.1.el8eap, 3.3.24-1.Final_redhat_00001.1.el9eap
eap8-jboss-logging (Red Hat package) - addressed in versions 3.5.3-1.Final_redhat_00001.1.el8eap, 3.5.3-1.Final_redhat_00001.1.el9eap
eap8-apache-commons-lang (Red Hat package) - addressed in versions 3.14.0-2.redhat_00006.1.el8eap, 3.14.0-2.redhat_00006.1.el9eap
eap8-jctools (Red Hat package) - addressed in versions 4.0.2-1.redhat_00001.1.el8eap, 4.0.2-1.redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.5-1.redhat_00001.1.el8eap, 4.0.5-1.redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.55-1.Final_redhat_00001.1.el7eap, 4.0.55-1.Final_redhat_00001.1.el8eap, 4.0.55-1.Final_redhat_00001.1.el9eap
eap8-jgroups (Red Hat package) - addressed in versions 5.3.10-1.Final_redhat_00001.1.el8eap, 5.3.10-1.Final_redhat_00001.1.el9eap
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.12-1.Final_redhat_00001.1.el7eap, 5.4.12-1.Final_redhat_00001.1.el8eap, 5.4.12-1.Final_redhat_00001.1.el9eap
eap8-narayana (Red Hat package) - addressed in versions 6.0.3-1.Final_redhat_00001.1.el8eap, 6.0.3-1.Final_redhat_00001.1.el9eap
eap7-hibernate-validator (Red Hat package) - addressed in versions 6.0.23-2.SP1_redhat_00001.1.el7eap, 6.0.23-2.SP1_redhat_00001.1.el8eap, 6.0.23-2.SP1_redhat_00001.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.2.31-1.Final_redhat_00002.1.el8eap, 6.2.31-1.Final_redhat_00002.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.19-1.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el8eap, 7.4.19-1.GA_redhat_00002.1.el9eap
eap8-shibboleth-java-support (Red Hat package) - addressed in versions 8.0.0-6.redhat_00001.1.el8eap, 8.0.0-6.redhat_00001.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-3.Final_redhat_00001.1.el8eap, 8.0.1-3.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.4-2.GA_redhat_00005.1.el8eap, 8.0.4-2.GA_redhat_00005.1.el9eap
eap8-objectweb-asm (Red Hat package) - addressed in versions 9.6.0-1.redhat_00002.1.el8eap, 9.6.0-1.redhat_00002.1.el9eap
eap8-nimbus-jose-jwt (Red Hat package) - addressed in versions 9.37.3-1.redhat_00001.1.el8eap, 9.37.3-1.redhat_00001.1.el9eap
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.4.0-1.GA_redhat_00001.1.el8eap, 800.4.0-1.GA_redhat_00001.1.el9eap

• https://access.redhat.com/security/cve/CVE-2024-4029
• https://bugzilla.redhat.com/show_bug.cgi?id=2278615
• https://github.com/advisories/GHSA-x7g6-rwhc-g7mj

• Denial of service in Wildfly Core
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8