CVE-2023-5685 Xnio: stackoverflowexception when the chain of notifier states becomes problematically big

2024-03-2218:24:42

CWE-400

redhat

github.com

xnio

stackoverflowexception

large notifier states

resource management

denial of service

dos

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS).

CNA Affected

[
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
    ],
    "vendor": "Red Hat",
    "product": "EAP 7.4.14",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:apache-camel-spring-boot:4.4.0"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4.4.0 for Spring Boot",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.8.11-1.SP1_redhat_00001.1.el8eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jboss-xnio-base",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.8.11-1.SP1_redhat_00001.1.el9eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jboss-xnio-base",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.8.11-1.SP1_redhat_00001.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jboss-xnio-base",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_spring_boot:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel for Spring Boot",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhboac_hawtio:4"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel - HawtIO",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:22"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Data Grid 8",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:integration:1"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Integration Camel K",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Data Grid 7",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 8",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_fuse_service_works:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Fuse Service Works 6",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Process Automation 7",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7",
    "packageName": "xnio",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  }
]