CVE-2020-4325

CWE-404CWE-119 — Buffer Overflow3 documents3 sources
Severity
6.5MEDIUM
EPSS
0.4%
top 40.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Process Federation ServerIBM Automation Workstream Services IN Cloud PAK FOR AutomationIBM Cloud PAK FOR Automation
Timeline
PublishedApr 2
Latest updateMay 24

Description

The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that it creates to retrieve Global Teams information from the federated systems. As a consequence, the Java Virtual Machine can't recover the memory used by those thread pools, which leads to an OutOfMemory exception when the Process Federation Server Global Teams REST API is used extensively. IBM X-Force ID: 177596.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶NVDibm/process_federation_server18.0.0.1 — 19.0.0.3
▶CVEListV5ibm/process_federation_server5 versions+4
▶NVDibm/cloud_pak19.0.3

🔴Vulnerability Details

2
GHSA
GHSA-f726-9xgv-wf6h: The IBM Process Federation Server 18↗2022-05-24
▶
CVEList
CVE-2020-4325: The IBM Process Federation Server 18↗2020-04-02
▶