Vulnerability Name:

CVE-2020-14340 (CCN-202925)

Assigned:2020-06-17
Published:2021-06-02
Updated:2022-07-25
Summary:A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
CVSS v3 Severity:5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.4 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2020-14340

Source: CCN
Type: Red Hat Bugzilla - Bug 1860218
(CVE-2020-14340) - CVE-2020-14340 xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS

Source: MISC
Type: Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1860218

Source: XF
Type: UNKNOWN
xnio-cve202014340-dos(202925)

Source: CCN
Type: Oracle CPUApr2022
Oracle Critical Patch Update Advisory - April 2022

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Source: CCN
Type: Oracle CPUJan2022
Oracle Critical Patch Update Advisory - January 2022

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html

Source: CCN
Type: XNIO Web site
XNIO

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:xnio:*:*:*:*:*:*:*:* (Version >= 3.8.0 and < 3.8.2)
  • OR cpe:/a:redhat:xnio:3.6.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:redhat:xnio:3.6.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:redhat:xnio:*:*:*:*:*:*:*:* (Version >= 3.6.1 and < 3.7.9)

    • Configuration 2:
  • cpe:/a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_brms:5:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_soa_platform:5:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_brms:6:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_data_grid:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_data_virtualization:6.0.0:-:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.15.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:redhat:xnio:3.8.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    redhat xnio *
    redhat xnio 3.6.0 beta1
    redhat xnio 3.6.0 beta2
    redhat xnio *
    redhat jboss operations network 3.0
    redhat jboss enterprise application platform 6.0.0
    redhat jboss fuse 6.0.0
    redhat jboss enterprise application platform 5.0.0
    redhat jboss fuse 7.0.0
    redhat jboss data grid 7.0.0
    redhat jboss brms 5
    redhat jboss soa platform 5
    redhat jboss brms 6
    redhat jboss data grid 6.0.0
    redhat jboss data virtualization 6.0.0 -
    oracle communications cloud native core network repository function 1.14.0
    oracle communications cloud native core policy 1.14.0
    oracle communications cloud native core unified data repository 1.14.0
    oracle communications cloud native core service communication proxy 1.14.0
    oracle communications cloud native core security edge protection proxy 1.15.0
    oracle communications cloud native core console 1.9.0
    redhat xnio 3.8.1