A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error.
References
Configurations
No configuration.
History
25 Nov 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-401 |
21 Nov 2024, 08:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2024:1662 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:1706 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:1923 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:2088 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:2833 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:3527 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:3989 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:4884 - | |
| References | () https://access.redhat.com/security/cve/CVE-2024-1300 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2263139 - | |
| References | () https://vertx.io/docs/vertx-core/java/#_server_name_indication_sni. - |
25 Jul 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Jun 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 May 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Apr 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Apr 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Apr 2024, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Apr 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-400 |
03 Apr 2024, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Apr 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-02 08:15
Updated : 2024-11-25 03:15
NVD link : CVE-2024-1300
Mitre link : CVE-2024-1300
CVE.ORG link : CVE-2024-1300
JSON object : View
Products Affected
No product.
CWE
CWE-401
Missing Release of Memory after Effective Lifetime