CVE-2020-4325

6.5MEDIUM

Key Information:

Vendor
IBM
Status
Process Federation Server
Automation Workstream Services In Cloud Pak For Automation
Vendor
CVE Published:
2 April 2020

Summary

The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the thread pools that it creates to retrieve Global Teams information from the federated systems. As a consequence, the Java Virtual Machine can't recover the memory used by those thread pools, which leads to an OutOfMemory exception when the Process Federation Server Global Teams REST API is used extensively. IBM X-Force ID: 177596.

Affected Version(s)

Automation Workstream Services in Cloud Pak for Automation 19.0.0.3

Process Federation Server 18.0.0.1

Process Federation Server 18.0.0.2

References

https://www.ibm.com/support/pages/node/6125403
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/177596
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.