{"id":"GHSA-qcch-9268-59jw","summary":"Wildfly EJB Client causes DoS","details":"A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventually unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.","aliases":["CVE-2020-14297"],"modified":"2024-03-10T05:17:19.068470Z","published":"2022-05-24T17:24:17Z","database_specific":{"cwe_ids":["CWE-400"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-07-13T21:16:34Z","nvd_published_at":"2020-07-24T16:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14297"},{"type":"WEB","url":"https://github.com/wildfly/jboss-ejb-client/commit/e5f8e4b591f1698a53adc7e430584ca2a8fc9f1b"},{"type":"WEB","url":"https://github.com/wildfly/jboss-ejb-client/commits/4.0.34.Final"},{"type":"PACKAGE","url":"https://github.com/wildfly/jboss-ejb-client"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1853595"},{"type":"WEB","url":"https://access.redhat.com/solutions/21906"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2020-14297"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2021:3140"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3817"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3642"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3639"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3638"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3637"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3539"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3501"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3464"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3463"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3462"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3461"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3144"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3143"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3142"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2020:3141"}],"affected":[{"package":{"name":"org.jboss:jboss-ejb-client","ecosystem":"Maven","purl":"pkg:maven/org.jboss/jboss-ejb-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.34.Final"}]}],"versions":["1.0.0.Beta1","1.0.0.Beta10","1.0.0.Beta11","1.0.0.Beta12","1.0.0.Beta2","1.0.0.Beta3","1.0.0.Beta4","1.0.0.Beta5","1.0.0.Beta6","1.0.0.Beta7","1.0.0.Beta8","1.0.0.Beta9","1.0.0.Final","1.0.1.Final","1.0.10.Final","1.0.11.Final","1.0.12.Final","1.0.13.Final","1.0.14.Final","1.0.15.Final","1.0.16.Final","1.0.17.Final","1.0.18.Final","1.0.19.Final","1.0.2.Final","1.0.20.Final","1.0.21.Final","1.0.22.Final","1.0.23.Final","1.0.24.Final","1.0.25.Final","1.0.26.Final","1.0.27.Final","1.0.28.Final","1.0.29.Final","1.0.3.Final","1.0.30.Final","1.0.31.Final","1.0.32.Final","1.0.33.Final","1.0.34.Final","1.0.35.Final","1.0.36.Final","1.0.37.Final","1.0.38.Final","1.0.39.Final","1.0.4.Final","1.0.40.Final","1.0.41.Final","1.0.5.Final","1.0.6.CR1","1.0.6.Final","1.0.7.Final","1.0.8.Final","1.0.9.Final","1.1.0.Alpha1","2.0.0.Beta1","2.0.0.Beta2","2.0.0.Beta3","2.0.0.Beta4","2.0.0.Beta5","2.0.0.Final","2.0.1.Final","2.0.2.Final","2.0.3.Final","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.1.5.Final","2.1.6.Final","2.1.7.Final","2.1.8.Final","3.0.0.Beta1","3.0.0.Beta2","3.0.0.Beta3","3.0.0.Beta4","3.0.0.Beta5","4.0.0.Beta1","4.0.0.Beta10","4.0.0.Beta11","4.0.0.Beta12","4.0.0.Beta13","4.0.0.Beta14","4.0.0.Beta15","4.0.0.Beta16","4.0.0.Beta17","4.0.0.Beta18","4.0.0.Beta19","4.0.0.Beta2","4.0.0.Beta20","4.0.0.Beta21","4.0.0.Beta22","4.0.0.Beta23","4.0.0.Beta24","4.0.0.Beta25","4.0.0.Beta25-jbossorg-1","4.0.0.Beta26","4.0.0.Beta27","4.0.0.Beta28","4.0.0.Beta29","4.0.0.Beta3","4.0.0.Beta30","4.0.0.Beta31","4.0.0.Beta4","4.0.0.Beta5","4.0.0.Beta6","4.0.0.Beta7","4.0.0.Beta8","4.0.0.Beta9","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.4.Final","4.0.5.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qcch-9268-59jw/GHSA-qcch-9268-59jw.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}