CVE-2017-12174

moderate-risk

Published 2018-03-07

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.

Do I need to act?

7.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (5)

Activemq Artemis

Hornetq

Jboss Enterprise Application Platform

Affected Vendors

Redhat Apache

References (24)

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0268

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0269

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0270

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0271

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0275

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0478

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0479

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0480

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0481

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12174

https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737...

https://lists.apache.org/thread.html/rc96ad63f148f784c84ea7f0a178c84a8985c6afcca...