CVE-2024-1300 — Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Description (CNA)

A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 4.3.4 through 4.5.2
Red Hat / CEQ 3.2	unaffected
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-7 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-9 before *
Red Hat / Cryostat 2 on RHEL 8	unaffected 2.4.0-4 before *
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-18 before *
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-11 before *
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-12 before *
Red Hat / Migration Toolkit for Runtimes 1 on RHEL 8	unaffected 1.2-10 before *
Red Hat / MTA-6.2-RHEL-9	unaffected 6.2.3-2 before *
Red Hat / Red Hat AMQ Streams 2.7.0	unaffected
Red Hat / Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2	unaffected
Red Hat / Red Hat build of Quarkus 3.2.11.Final	unaffected 4.4.8.redhat-00001 before *
Red Hat / RHINT Service Registry 2.5.11 GA	unaffected
Red Hat / A-MQ Clients 2	unaffected
Red Hat / OpenShift Serverless	unaffected
Red Hat / Red Hat AMQ Broker 7	unaffected
Red Hat / Red Hat build of Apache Camel 4 for Quarkus 3	affected
Red Hat / Red Hat build of Apache Camel for Spring Boot 3	affected
Red Hat / Red Hat Build of Keycloak	affected
Red Hat / Red Hat build of OptaPlanner 8	affected
Red Hat / Red Hat build of Quarkus	affected
Red Hat / Red Hat Data Grid 8	unaffected
Red Hat / Red Hat Fuse 7	unaffected
Red Hat / Red Hat Integration Camel K 1	affected
Red Hat / Red Hat Integration Camel Quarkus 2	affected
Red Hat / Red Hat JBoss Data Grid 7	affected
Red Hat / Red Hat JBoss Enterprise Application Platform 7	unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 8	unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Pack	unaffected
Red Hat / Red Hat Process Automation 7	affected

CWE

CWE-772

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.