CVE-2014-0086 JBoss RichFaces Improper Input Validation vulnerability
MediumCVSS 4.3
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.richfaces/richfaces(Maven) | >= 4.3.4, <= 4.3.5 | No fix listed |
| org.richfaces/richfaces(Maven) | >= 5.0.0.Alpha1, < 5.0.0.Alpha3 | 5.0.0.Alpha3 |
| org.richfaces/richfaces(Maven) | = 5.0.0.Alpha1 | No fix listed |
| org.richfaces/richfaces(Maven) | = 5.0.0.Alpha2 | No fix listed |
| redhat jboss web framework kit | = 2.5.0 | No fix listed |
| redhat richfaces | = 4.3.4 | No fix listed |
| redhat richfaces | = 4.3.5 | No fix listed |
| redhat richfaces | = 5.0.0-alpha1 | No fix listed |
| redhat richfaces | = 5.0.0-alpha2 | No fix listed |
| redhat richfaces | = 5.0.0-alpha3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch
- bugzilla.redhat.com
- issues.jboss.org patch
- RHSA-2014:0335 vendor-advisory
- github.com patch
- github.com
- github.com product
- 57053 third-party-advisory vendor-advisory