VDB

CVE-2023-1108

CVE-2023-1108 PUBLISHED CVSS 7.5 HIGH

Undertow: infinite loop in sslconduit during close

Reported by redhat · Published September 14, 2023

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
2.3.5, 2.2.24
Red HatEAP 7.4.10 release
Red HatRed Hat Fuse 7.12
Red HatRed Hat JBoss Enterprise Application Platform 7.1.0
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 80:2.2.22-1.SP3_redhat_00002.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 80:7.4.9-6.GA_redhat_00004.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 80:2.2.23-1.SP2_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 80:2.0.14-1.Final_redhat_00001.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 90:2.2.22-1.SP3_redhat_00002.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 90:7.4.9-6.GA_redhat_00004.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 90:2.2.23-1.SP2_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 for RHEL 90:2.0.14-1.Final_redhat_00001.1.el9eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 70:2.2.22-1.SP3_redhat_00002.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 70:7.4.9-6.GA_redhat_00004.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 70:2.2.23-1.SP2_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 on RHEL 70:2.0.14-1.Final_redhat_00001.1.el7eap
Red HatRed Hat Single Sign-On 7
Red HatRed Hat Single Sign-On 7.6 for RHEL 70:18.0.8-1.redhat_00001.1.el7sso
Red HatRed Hat Single Sign-On 7.6 for RHEL 80:18.0.8-1.redhat_00001.1.el8sso
Red HatRed Hat Single Sign-On 7.6 for RHEL 90:18.0.8-1.redhat_00001.1.el9sso

…and 41 more

Timeline

  • Mar 9, 2023 CVE Published
  • Sep 14, 2023 PoC Published (2 in total, the first dated here)
  • Sep 15, 2023 EPSS Score (30 in total, the first dated here)
  • Nov 16, 2023 CVE Updated
  • Mar 17, 2026 Security Advisory (17 in total, the first dated here)
  • Mar 27, 2026 Distribution Patch (16 in total, the first dated here)
  • May 21, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-1108
vulnetix vdb fixes CVE-2023-1108

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-1108/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›