CVE-2020-35510: 
Java vulnerability analysis and mitigation

CVE-2020-35510 is a vulnerability discovered in jboss-remoting versions before 5.0.20.SP1-redhat-00001. The vulnerability allows a malicious attacker to cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request while omitting the ACK messages, or by tampering with jboss-remoting code to delete the lines that send the ACK message from the EJB client code (NVD).

The vulnerability affects the EJB server component of jboss-remoting. The technical mechanism involves the manipulation of ACK messages in the client-server communication process. The CVSS v3.1 base score is 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility with high attack complexity and no required privileges or user interaction (NVD).

The primary impact of this vulnerability is on system availability. By exploiting this vulnerability, an attacker can cause a denial of service condition in the EJB server by preventing proper thread completion (Red Hat Bugzilla).

The vulnerability requires network access and involves manipulating the EJB client request sequence by either omitting ACK messages or modifying the jboss-remoting code. While the attack complexity is rated as high, no special privileges or user interaction are required for exploitation (NVD).

The vulnerability has been fixed in jboss-remoting version 5.0.20.SP1-redhat-00001. Users are advised to upgrade to this version or later. Red Hat has released security updates for affected products including JBoss Enterprise Application Platform 7.3.6 (Red Hat Advisory).