CVE-2023-1108: Undertow: infinite loop in sslconduit during close
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
Other sources
https://issues.redhat.com/browse/UNDERTOW-2239
A denial-of-service vulnerability found in Undertow :
Latest JDKs from the January 18th release (jdk 11.0.18, and may be jdk 17.0.6) include this change: https://github.com/openjdk/jdk11u/commit/243a55ef31e9584467482c6159501b5d522a9427#diff-fd78e578d9d538ff23130422a81e277b5482ac752dc158b6dc07737a9c4c3f4bR737-L737 Which is suspected to be the cause of an infinite loop in SslConduit here: https://github.com/undertow-io/undertow/blob/d508c1328ba5c1ca228bfcc405f2c6b9321a1139/core/src/main/java/io/undertow/protocols/ssl/SslConduit.java#L1002-L1004
Where there is HandshakeStatus.NEEDWRAP but the status is updated to Status.CLOSED (new in this JDK release) so the loop never terminates.
— Red Hat
Undertow is vulnerable to a denial of service, caused by an infinite loop in SslConduit during close on JDK 11. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2023-1108.
What is the severity of CVE-2023-1108?
The severity of CVE-2023-1108 is high.
What is the affected software for CVE-2023-1108?
The affected software for CVE-2023-1108 is Undertow.
How do I fix CVE-2023-1108?
To fix CVE-2023-1108, update Undertow to version 2.2.24 or 2.3.5.
Where can I find more information about CVE-2023-1108?
You can find more information about CVE-2023-1108 at the following references: [Reference 1](https://access.redhat.com/errata/RHSA-2023:1184), [Reference 2](https://access.redhat.com/errata/RHSA-2023:1185), [Reference 3](https://access.redhat.com/errata/RHSA-2023:1512)