CVE-2017-2670

Опубликовано: 27 июл. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

Ссылки

http://rhn.redhat.com/errata/RHSA-2017-1409.html
Vendor Advisory
http://www.securityfocus.com/bid/98965
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2017:1410
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1411
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1412
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3454
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3455
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3456
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3458
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2670
Issue Tracking
Vendor Advisory
https://www.debian.org/security/2017/dsa-3906
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1409.html
Vendor Advisory
http://www.securityfocus.com/bid/98965
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2017:1410
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1411
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1412
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3454
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3455
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3456
Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3458
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*

Версия до 1.3.28 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

Одно из

cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.03616

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-835

Связанные уязвимости

CVE-2017-2670

CVSS3: 7.5

ubuntu

больше 8 лет назад

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

CVE-2017-2670

CVSS3: 7.5

redhat

больше 9 лет назад

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

CVE-2017-2670

CVSS3: 7.5

debian

больше 8 лет назад

It was found in Undertow before 1.3.28 that with non-clean TCP close, ...

GHSA-3x7h-5hfr-hvjm

CVSS3: 7.5

github

около 8 лет назад

Moderate severity vulnerability that affects io.undertow:undertow-core

ALT-PU-2016-3279

CVSS3: 7.5

altlinux

почти 10 лет назад

ALT-PU-2016-3279: package `undertow` update to version 1.4.0-alt1_1jpp8

EPSS

Процентиль: 90%

0.03616

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-835