CVE-2020-4325: The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that…

PriorityP433medium6.5CVSS 3.1

AVNACLPRLUINSUCNINAH

EPSS

1.46%

70.4th percentile

The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that it creates to retrieve Global Teams information from the federated systems. As a consequence, the Java Virtual Machine can't recover the memory used by those thread pools, which leads to an OutOfMemory exception when the Process Federation Server Global Teams REST API is used extensively. IBM X-Force ID: 177596.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
ibm	automation_workstream_services_in_cloud_pak_for_automation	—	—
ibm	cloud_pak_for_automation	—	—
ibm	process_federation_server	—	—
ibm	process_federation_server	—	—
ibm	process_federation_server	—	—
ibm	process_federation_server	—	—
ibm	process_federation_server	—	—
ibm	process_federation_server	18.0.0.1 – 19.0.0.3	—

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.