CVE-2020-27822: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2020-27822) was discovered in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. The flaw occurs when an application uses the OpenTracing API's java-interceptors, potentially causing a memory leak that could impact server availability (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-401 (Missing Release of Memory after Effective Lifetime). The flaw specifically relates to memory management issues when utilizing OpenTracing API's java-interceptors functionality (NVD).

The primary impact of this vulnerability is on system availability. When exploited, the memory leak can eventually lead to service unavailability. The vulnerability affects only the availability aspect, with no direct impact on confidentiality or integrity of the system (NVD, Red Hat Bugzilla).

The vulnerability requires network access (AV:N) but has high attack complexity (AC:H). No authentication (PR:N) or user interaction (UI:N) is required to exploit the vulnerability. The scope is unchanged (S:U), indicating the impact is limited to the vulnerable component (NVD).

The vulnerability has been addressed through security updates released by Red Hat. Multiple security advisories have been issued including RHSA-2021:0250 for JBoss Enterprise Application Platform 7.3.5, RHSA-2021:0295 for Red Hat build of Thorntail 2.7.3, and other related patches. Users are advised to update to the patched versions (Red Hat Advisory).