VDB
CVE-2018-1114
CVE-2018-1114
PUBLISHED
CVSS 6.5 MEDIUM
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
EPSS 2.33% · 82.9th percentile
Risk Scores
CVSS 3.0
6.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
2.33%
82.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | undertow | 0, 2.0.23-1, 2.0.27-1 |
| Ubuntu:24.04:LTS | undertow | 2.3.8-2, 0 |
| Ubuntu:16.04:LTS | undertow | 1.3.16-1, 0, 1.3.4-1 |
| Ubuntu:22.04:LTS | undertow | 2.2.13-1, 0, 2.2.8-1 |
| Ubuntu:18.04:LTS | undertow | 1.4.20-1, 1.4.22-1, 1.4.23-2build1 |
Timeline
- Sep 11, 2018 CVE Published
- Oct 9, 2019 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Mar 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jul 5, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Nov 8, 2022 EPSS Score
- Jan 10, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-1114 third-party-advisory
- https://issues.jboss.org/browse/UNDERTOW-1338 third-party-advisory
- https://bugs.openjdk.java.net/browse/JDK-6956385 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-1114 third-party-advisory