Memory leak in Apache CXF - CVE-2024-41172

Vulnerability identifier: #VU97630

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-41172

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in HTTPClient. A remote attacker can force the application to leak memory and perform denial of service attack.

Apache CXF
JBoss Enterprise Application Platform
eap8-asyncutil (Red Hat package)
eap8-hppc (Red Hat package)
eap8-insights-java-client (Red Hat package)
eap8-jboss-cert-helper (Red Hat package)
eap8-cryptacular (Red Hat package)
eap8-aesh-extensions (Red Hat package)
eap8-aws-java-sdk (Red Hat package)
eap8-apache-commons-codec (Red Hat package)
eap8-artemis-native (Red Hat package)
eap8-activemq-artemis-native (Red Hat package)
eap8-artemis-wildfly-integration (Red Hat package)
eap8-resteasy-extensions (Red Hat package)
eap8-slf4j (Red Hat package)
eap8-fastinfoset (Red Hat package)
eap8-snakeyaml (Red Hat package)
eap8-aesh-readline (Red Hat package)
eap8-pem-keystore (Red Hat package)
eap8-apache-commons-io (Red Hat package)
eap8-log4j (Red Hat package)
eap8-activemq-artemis (Red Hat package)
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package)
eap8-resteasy-spring (Red Hat package)
eap8-saaj-impl (Red Hat package)
eap8-apache-commons-collections (Red Hat package)
eap8-jboss-logging (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-jctools (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-jgroups (Red Hat package)
eap8-narayana (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-shibboleth-java-support (Red Hat package)
eap8-hibernate-validator (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-objectweb-asm (Red Hat package)
eap8-nimbus-jose-jwt (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Red Hat Camel for Spring Boot
Maximo Application Suite - IoT Component
IBM Cloud Pak for Business Automation

Install updates from vendor's website.

Apache CXF - addressed in versions 3.6.4, 4.0.5
JBoss Enterprise Application Platform - update to 8.0.4
eap8-asyncutil (Red Hat package) - addressed in versions 0.1.0-2.redhat_00010.1.el8eap, 0.1.0-2.redhat_00010.1.el9eap
eap8-hppc (Red Hat package) - addressed in versions 0.8.1-2.redhat_00001.1.el8eap, 0.8.1-2.redhat_00001.1.el9eap
eap8-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap8-cryptacular (Red Hat package) - addressed in versions 1.2.5-2.redhat_00001.1.el8eap, 1.2.5-2.redhat_00001.1.el9eap
eap8-aesh-extensions (Red Hat package) - addressed in versions 1.8.0-2.redhat_00001.1.el8eap, 1.8.0-2.redhat_00001.1.el9eap
eap8-aws-java-sdk (Red Hat package) - addressed in versions 1.12.284-2.redhat_00002.1.el8eap, 1.12.284-2.redhat_00002.1.el9eap
eap8-apache-commons-codec (Red Hat package) - addressed in versions 1.16.1-2.redhat_00007.1.el8eap, 1.16.1-2.redhat_00007.1.el9eap
eap8-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-activemq-artemis-native (Red Hat package) - addressed in versions 2.0.0-2.redhat_00005.1.el8eap, 2.0.0-2.redhat_00005.1.el9eap
eap8-artemis-wildfly-integration (Red Hat package) - addressed in versions 2.0.1-1.redhat_00002.1.el8eap, 2.0.1-1.redhat_00002.1.el9eap
eap8-resteasy-extensions (Red Hat package) - addressed in versions 2.0.1-3.Final_redhat_00001.1.el8eap, 2.0.1-3.Final_redhat_00001.1.el9eap
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-1.redhat_00001.1.el8eap, 2.0.16-1.redhat_00001.1.el9eap
eap8-fastinfoset (Red Hat package) - addressed in versions 2.1.0-4.redhat_00001.1.el8eap, 2.1.0-4.redhat_00001.1.el9eap
eap8-snakeyaml (Red Hat package) - addressed in versions 2.2.0-1.redhat_00001.1.el8eap, 2.2.0-1.redhat_00001.1.el9eap
eap8-aesh-readline (Red Hat package) - addressed in versions 2.2.0-2.redhat_00001.1.el8eap, 2.2.0-2.redhat_00001.1.el9eap
eap8-pem-keystore (Red Hat package) - addressed in versions 2.3.0-1.redhat_00001.1.el8eap, 2.3.0-1.redhat_00001.1.el9eap
eap8-apache-commons-io (Red Hat package) - addressed in versions 2.15.1-1.redhat_00001.1.el8eap, 2.15.1-1.redhat_00001.1.el9eap
eap8-log4j (Red Hat package) - addressed in versions 2.22.1-1.redhat_00002.1.el8eap, 2.22.1-1.redhat_00002.1.el9eap
eap8-activemq-artemis (Red Hat package) - addressed in versions 2.33.0-1.redhat_00015.1.el8eap, 2.33.0-1.redhat_00015.1.el9eap
eap8-jakarta-servlet-jsp-jstl-api (Red Hat package) - addressed in versions 3.0.1-1.redhat_00001.1.el8eap, 3.0.1-1.redhat_00001.1.el9eap
eap8-resteasy-spring (Red Hat package) - addressed in versions 3.0.1-2.Final_redhat_00001.1.el8eap, 3.0.1-2.Final_redhat_00001.1.el9eap
eap8-saaj-impl (Red Hat package) - addressed in versions 3.0.4-1.redhat_00001.1.el8eap, 3.0.4-1.redhat_00001.1.el9eap
eap8-apache-commons-collections (Red Hat package) - addressed in versions 3.2.2-28.redhat_2.1.el8eap, 3.2.2-28.redhat_2.1.el9eap
eap8-jboss-logging (Red Hat package) - addressed in versions 3.5.3-1.Final_redhat_00001.1.el8eap, 3.5.3-1.Final_redhat_00001.1.el9eap
eap8-apache-commons-lang (Red Hat package) - addressed in versions 3.14.0-2.redhat_00006.1.el8eap, 3.14.0-2.redhat_00006.1.el9eap
eap8-jctools (Red Hat package) - addressed in versions 4.0.2-1.redhat_00001.1.el8eap, 4.0.2-1.redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.5-1.redhat_00001.1.el8eap, 4.0.5-1.redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - addressed in versions 4.4.0, 4.4.2
eap8-jgroups (Red Hat package) - addressed in versions 5.3.10-1.Final_redhat_00001.1.el8eap, 5.3.10-1.Final_redhat_00001.1.el9eap
eap8-narayana (Red Hat package) - addressed in versions 6.0.3-1.Final_redhat_00001.1.el8eap, 6.0.3-1.Final_redhat_00001.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.2.31-1.Final_redhat_00002.1.el8eap, 6.2.31-1.Final_redhat_00002.1.el9eap
eap8-shibboleth-java-support (Red Hat package) - addressed in versions 8.0.0-6.redhat_00001.1.el8eap, 8.0.0-6.redhat_00001.1.el9eap
eap8-hibernate-validator (Red Hat package) - addressed in versions 8.0.1-3.Final_redhat_00001.1.el8eap, 8.0.1-3.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.4-2.GA_redhat_00005.1.el8eap, 8.0.4-2.GA_redhat_00005.1.el9eap
Maximo Application Suite - IoT Component - addressed in versions 8.7.17, 8.8.12, 9.0.3, 9.1.0
eap8-objectweb-asm (Red Hat package) - addressed in versions 9.6.0-1.redhat_00002.1.el8eap, 9.6.0-1.redhat_00002.1.el9eap
eap8-nimbus-jose-jwt (Red Hat package) - addressed in versions 9.37.3-1.redhat_00001.1.el8eap, 9.37.3-1.redhat_00001.1.el9eap
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.4.0-1.GA_redhat_00001.1.el8eap, 800.4.0-1.GA_redhat_00001.1.el9eap

• https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6

• Multiple vulnerabilities in Apache CXF
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.4
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• IBM Maximo Application Suite - IoT Component update for Apache CXF
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation