CVE-2020-14297: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2020-14297) was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where specific EJB transaction objects may accumulate over time in the InvocationTracker. This vulnerability was disclosed in July 2020 and affects Red Hat JBoss Enterprise Application Platform and related products (CVE Details, Red Hat CVE).

The vulnerability exists in the EJB Client component where specific EJB transaction objects can accumulate in the InvocationTracker over time. This accumulation of objects leads to resource consumption that can impact system performance (Bugzilla).

The accumulation of EJB transaction objects can cause services to slow down and eventually become unavailable, resulting in a Denial of Service (DoS) condition. An attacker can potentially exploit this vulnerability to make services unavailable (CVE Details).

The vulnerability can be exploited by triggering conditions that lead to the accumulation of EJB transaction objects in the system. This can be achieved through normal system operation, making it a reliability concern that could be deliberately exploited for denial of service attacks (Red Hat CVE).

Red Hat has addressed this vulnerability through several security updates. Multiple patches were released through various security advisories (RHSA) including RHSA-2020:3141, RHSA-2020:3142, RHSA-2020:3143, and RHSA-2020:3144 for different versions of JBoss Enterprise Application Platform. Users are advised to update to the patched versions (Red Hat Advisory).