CVE-2019-19343: 
JBoss EAP vulnerability analysis and mitigation

A memory leak vulnerability was discovered in Undertow when using Remoting as shipped in Red Hat JBoss EAP before version 7.2.4. The vulnerability, identified as CVE-2019-19343, affects versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1. The issue was first reported in November 2019 and was addressed through security updates released in 2020 (Red Hat Advisory, NVD).

The vulnerability stems from a memory leak in HttpOpenListener component due to holding remote connections indefinitely. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release) (NVD, NetApp Advisory).

Successful exploitation of this vulnerability could lead to denial of service (DoS) due to unbounded memory growth caused by indefinitely held remote connections. The impact primarily affects the availability of the system, with no direct effect on confidentiality or integrity (NetApp Advisory).

The vulnerability has been fixed in undertow version 2.0.25.SP1 and jboss-remoting version 5.0.14.SP1. Users are advised to upgrade to these versions or later. The fix was implemented through changes in remoting, although the issue manifested in an Undertow use case (Red Hat Bugzilla).