CVE-2020-27217: 
Java vulnerability analysis and mitigation

In Eclipse Hono version 1.3.0 and 1.4.0, a critical vulnerability was discovered in the AMQP protocol adapter. The adapter fails to verify the size of AMQP messages received from devices, allowing messages larger than the indicated max-message-size during link establishment. This vulnerability was discovered in September 2020 and was assigned CVE-2020-27217 (Eclipse Bug).

The vulnerability stems from a flaw in the vertx-proton library used by the AMQP adapter, which fails to reject transfers exceeding the configured max-message-size. While the AMQP 1.0 protocol explicitly disallows peers to send messages larger than the established maximum size, the implementation doesn't enforce this restriction. The vertx-proton library assembles individual transfers into the final message in-memory, making the adapter susceptible to memory resource exploitation. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (NVD).

A malicious attacker could exploit this vulnerability by crafting an AMQP 1.0 client to send messages of unlimited size to the adapter. This could lead to excessive memory consumption and eventually cause the adapter to fail with an out-of-memory exception, resulting in a denial of service condition (Eclipse Bug).

The vulnerability can be easily exploited by a client and can be used for a simple DoS attack on the AMQP adapter. The attack requires no special privileges or user interaction, making it particularly dangerous. The underlying issue was identified in the vertx-proton library and has been fixed in Vert.x 3.9.3 (Eclipse Bug).

The vulnerability has been fixed in subsequent releases of Eclipse Hono. Users are advised to upgrade to patched versions. The fix was implemented by updating to a newer version of the vertx-proton library that properly enforces message size limits (Eclipse Bug).