CVE-2020-25644: 
Java vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2020-25644) was discovered in WildFly OpenSSL versions prior to 1.1.3.Final. The vulnerability was disclosed on October 6, 2020, affecting the HTTP session removal process. This vulnerability impacts various products that incorporate WildFly, including Red Hat JBoss Enterprise Application Platform, NetApp Service Level Manager, OnCommand Insight, and OnCommand Workflow Automation (NVD, NetApp Advisory).

The vulnerability occurs when removing an HTTP session, where SSL_SESSION_free(session) is not called by remove_session_cb, resulting in a memory leak. The issue is particularly severe when client certificate authentication is used, as the session contains certificates, leading to larger memory leaks. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Red Hat Bugzilla, NVD).

The primary impact of this vulnerability is on system availability. When successfully exploited, it can lead to Out of Memory (OOM) conditions, ultimately resulting in a denial of service (DoS). The impact is particularly significant in systems using client certificate authentication due to the larger memory footprint of stored certificates (NVD, NetApp Advisory).

The vulnerability can be exploited remotely with low attack complexity and requires no privileges or user interaction. While public discussion of this vulnerability exists, there are no specific details about active exploitation in the wild (NetApp Advisory).

The vulnerability was fixed in WildFly OpenSSL version 1.1.3.Final. Various vendors have released patches and updates to address this issue. Red Hat has released security updates for affected products including JBoss Enterprise Application Platform. NetApp has provided patches for OnCommand Insight and OnCommand Workflow Automation. No workarounds are available for this vulnerability, making patch installation the only effective mitigation (Red Hat Bugzilla, NetApp Advisory).