In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enf
What fixes it
- 5.2.1vertx-redis-client, mavenGitHub
- 5.1.10vertx-redis-client, mavenGitHub
- 4.5.35vertx-redis-client, mavenGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. A malicious or compromised Redis server, or an attacker in a man-in-the-middle position, can send a crafted RESP response declaring an extremely large array, push, or attribute length, causing the client to attempt a massive heap allocation. The resulting OutOfMemoryError crashes the Vert.x event loop thread, denying service to all connections and verticles sharing that loop.
The impacted component is io.vertx:vertx-mysql-client.
Text from GitHub Advisory Database
Affected versions 7
- Eclipse Vert.xaffected: 4.0.0 through 4.5.34CVE List
- Eclipse Vert.xaffected: 5.0.0 through 5.0.12CVE List
- Eclipse Vert.xaffected: 5.1.0 through 5.1.9CVE List
- Eclipse Vert.xaffected: 5.2.0CVE List
- vertx-redis-client, maven5.2.0GitHub
- vertx-redis-client, maven>=5.0.0, <=5.1.8GitHub
- vertx-redis-client, maven<=4.5.34GitHub