CVE-2023-1108

Опубликовано: 14 сент. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Ссылки

https://access.redhat.com/errata/RHSA-2023:1184
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1185
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1512
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1513
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1514
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1516
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:2135
https://access.redhat.com/errata/RHSA-2023:3883
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3884
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3885
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3888
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3892
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3954
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:4612
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-1108
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2174246
Issue Tracking
https://github.com/advisories/GHSA-m4mm-pg93-fv78
https://security.netapp.com/advisory/ntap-20231020-0002/
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:1184
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1185
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*

cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*

cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*

Версия до 2.2.24 (исключая)

cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*

Версия от 2.3.0 (включая) до 2.3.5 (исключая)

Конфигурация 2

Одновременно

Одно из

cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

EPSS

Процентиль: 67%

0.00546

Низкий

7.5 High

CVSS3

Дефекты

CWE-835

Связанные уязвимости

CVE-2023-1108

CVSS3: 7.5

ubuntu

больше 2 лет назад

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

CVE-2023-1108

CVSS3: 7.5

redhat

почти 3 года назад

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

CVE-2023-1108

CVSS3: 7.5

debian

больше 2 лет назад

A flaw was found in undertow. This issue makes achieving a denial of s ...

GHSA-m4mm-pg93-fv78

CVSS3: 7.5

github

больше 2 лет назад

Undertow denial of service vulnerability

BDU:2023-01996

CVSS3: 7.5

fstec

почти 3 года назад

Уязвимость веб-сервера Undertow, связанная с выполнением цикла с недоступным условием выхода, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 67%

0.00546

Низкий

7.5 High

CVSS3

Дефекты

CWE-835