Red Hat build of Apache Camel 4.4.1 for Spring…: Uncontrolled Resource Consumption

What to do

1. Check which version of Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 you run against the affected versions below, and install the vendor's latest release.
2. Read the advisory on security.netapp.com for workarounds and exact fixed builds.
3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 13 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

NoneNo data is disclosed.

Integrity

NoneNothing can be modified.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA (redhat.com).

Official description

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Uncontrolled Resource Consumption

Timeline

1. February 19, 2024CVE record published.
2. February 22, 2024CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
3. November 4, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2

• 7.5 High severity

  Red Hat build of Apache Camel 3.20.7 for…: Uncontrolled Recursion

  CVE-2024-5971Jul 8, 2024Red HatEPSS 2.92%
• 7.5 High severity

  EAP 8.0.1: Exposure of Data Element to Wrong Session

  CVE-2024-6162Jun 20, 2024Red HatEPSS 1.7%

Recent Uncontrolled Resource Consumption vulnerabilities

• 7.5 High severity

  Hci Baseboard Management Controller: Uncontrolled Resource Consumption

  CVE-2023-50868Feb 14, 2024NetAppEPSS 74.3%
• 7.5 High severity

  mod_auth_openidc: Uncontrolled Resource Consumption

  CVE-2024-24814Feb 13, 2024OpenIDCEPSS 1.25%
• 7.5 High severity

  F30 03X YY (COM): Uncontrolled Resource Consumption

  CVE-2024-24781Feb 13, 2024HIMA
• 7.5 High severity

  Niagara Framework: Uncontrolled Resource Consumption

  CVE-2024-1309Feb 13, 2024Honeywell
• 7.5 High severity

  libgit2: Uncontrolled Resource Consumption

  CVE-2024-24575Feb 6, 2024Libgit2EPSS 1.44%
• 7.5 High severity

  libexpat: Uncontrolled Resource Consumption

  CVE-2023-52425Feb 4, 2024Libexpat ProjectEPSS 2.15%

Spotted an error? Tell us.