Skip to content
Fencer Intel
medium 6.5

CVE-2020-14307 json

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations…

published 6y ago modified 4mo ago also EUVD-2020-6459

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.

Patch / fix

  • qpid-cpp a mq clients 2 1.36.0-31.el6_10amq
  • qpid-cpp a mq clients 2 1.36.0-31.el7amq
  • nodejs-rhea a mq clients 2 1.0.24-1.el8
  • qpid-proton a mq clients 2 0.32.0-1.el6_10
  • qpid-proton a mq clients 2 0.32.0-2.el7
  • qpid-proton a mq clients 2 0.32.0-2.el8
  • qpid-proton-c a mq clients 2 0.32.0-1.el6_10
  • qpid-proton-c a mq clients 2 0.32.0-2.el7

red hat advisories RHSA-2020:3817RHSA-2020:3639RHSA-2020:3638RHSA-2020:3637RHSA-2020:3463RHSA-2020:3462

Is CVE-2020-14307 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14307 updated cvss 6.5

wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service

  • Red Hat BPM Suite 6 jboss-ejb-client
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7 jboss-ejb-client
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 jboss-ejb-client Red Hat JBoss Enterprise Application Platform 6 jboss-ejb-client Red Hat JBoss Enterprise Application Platform Continuous Delivery jboss-ejb-client Red Hat JBoss Fuse 6 jboss-ejb-client Red Hat JBoss Operations Network 3 jboss-ejb-client
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes jboss-ejb-client
    affected: no fix available
  • Red Hat AMQ Clients 2 nodejs-rhea 1.0.24-1.el8, qpid-proton 0.32.0-2.el7, qpid-proton 0.32.0-2.el8, qpid-cpp 1.36.0-31.el7amq, qpid-proton-c 0.32.0-2.el7, qpid-proton-c 0.32.0-2.el8, +16 more
    fixed: vendor fix RHSA-2020:3817
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2020:3144
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.8-6.GA_redhat_00003.1.el6eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el6eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el6eap, +93 more
    fixed: vendor fix RHSA-2020:3637
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.8-6.GA_redhat_00003.1.el7eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el7eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el7eap, +97 more Red Hat JBoss EAP 7.2 for RHEL 8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.8-6.GA_redhat_00003.1.el8eap, eap7-wildfly 7.2.9-4.GA_redhat_00003.1.el8eap, eap7-resteasy 3.6.1-10.SP9_redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, eap7-weld-ejb 3.0.6-4.Final_redhat_00004.1.el8eap, +93 more
    fixed: vendor fix RHSA-2020:3142
show 7 more
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-dom4j 2.1.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.3.1-7.GA_redhat_00004.1.el8, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el8eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el8eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el8eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el8eap, +85 more
    fixed: vendor fix RHSA-2020:3141
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el6eap, eap7-wildfly 7.3.1-7.GA_redhat_00004.1.el6eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el6eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el6eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el6eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el6eap, +85 more
    fixed: vendor fix RHSA-2020:3461
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-dom4j 2.1.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.3.1-7.GA_redhat_00004.1.el7eap, eap7-wildfly 7.3.2-4.GA_redhat_00002.1.el7eap, eap7-netty 4.1.48-1.Final_redhat_00001.1.el7eap, eap7-jackson-core 2.10.4-1.redhat_00001.1.el7eap, eap7-undertow 2.0.30-4.SP4_redhat_00001.1.el7eap, +89 more
    fixed: vendor fix RHSA-2020:3141
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2020:3143
  • Red Hat Single Sign-On 7.4.2
    fixed: vendor fix RHSA-2020:3501
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2020:3539
  • Red Hat Data Grid 8 wildfly wildfly Red Hat Decision Manager 7 jboss-ejb-client Red Hat Process Automation 7 jboss-ejb-client
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected products

  • Red Hat wildfly

Classification

Weakness
  • CWE-404 Improper Resource Shutdown or Release

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.