CVE-2023-1108

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1108
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:1184 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1185 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1512 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1513 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1514 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1516 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:2135
https://access.redhat.com/errata/RHSA-2023:3883 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3884 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3885 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3888 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3892 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3954 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:4612 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-1108 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2174246 Issue Tracking
https://github.com/advisories/GHSA-m4mm-pg93-fv78
https://security.netapp.com/advisory/ntap-20231020-0002/ Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:1184 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1185 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1512 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1513 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1514 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1516 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:2135
https://access.redhat.com/errata/RHSA-2023:3883 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3884 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3885 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3888 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3892 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3954 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:4612 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-1108 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2174246 Issue Tracking
https://github.com/advisories/GHSA-m4mm-pg93-fv78
https://security.netapp.com/advisory/ntap-20231020-0002/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:38

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:1184 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:1184 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:1185 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:1185 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:1512 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:1512 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:1513 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:1513 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:1514 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:1514 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:1516 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:1516 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:2135 - () https://access.redhat.com/errata/RHSA-2023:2135 -
References () https://access.redhat.com/errata/RHSA-2023:3883 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:3883 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:3884 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:3884 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:3885 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:3885 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:3888 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:3888 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:3892 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:3892 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:3954 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:3954 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:4612 - Vendor Advisory () https://access.redhat.com/errata/RHSA-2023:4612 - Vendor Advisory
References () https://access.redhat.com/security/cve/CVE-2023-1108 - Vendor Advisory () https://access.redhat.com/security/cve/CVE-2023-1108 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2174246 - Issue Tracking () https://bugzilla.redhat.com/show_bug.cgi?id=2174246 - Issue Tracking
References () https://github.com/advisories/GHSA-m4mm-pg93-fv78 - () https://github.com/advisories/GHSA-m4mm-pg93-fv78 -
References () https://security.netapp.com/advisory/ntap-20231020-0002/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20231020-0002/ - Third Party Advisory

03 May 2024, 16:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:2135 -
  • () https://github.com/advisories/GHSA-m4mm-pg93-fv78 -

16 Nov 2023, 00:46

Type Values Removed Values Added
References (MISC) https://security.netapp.com/advisory/ntap-20231020-0002/ - (MISC) https://security.netapp.com/advisory/ntap-20231020-0002/ - Third Party Advisory
First Time Netapp oncommand Workflow Automation
Netapp
CPE cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

20 Oct 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) https://security.netapp.com/advisory/ntap-20231020-0002/ -

20 Sep 2023, 20:16

Type Values Removed Values Added
CPE cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Redhat jboss Enterprise Application Platform
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat single Sign-on
Redhat build Of Quarkus
Redhat openstack Platform
Redhat openshift Container Platform For Linuxone
Redhat decision Manager
Redhat openshift Application Runtimes
Redhat process Automation
Redhat integration Camel K
Redhat enterprise Linux
Redhat
Redhat openshift Container Platform For Power
Redhat undertow
Redhat openshift Container Platform
Redhat fuse
Redhat integration Service Registry
References (MISC) https://access.redhat.com/errata/RHSA-2023:3884 - (MISC) https://access.redhat.com/errata/RHSA-2023:3884 - Vendor Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2174246 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2174246 - Issue Tracking
References (MISC) https://access.redhat.com/errata/RHSA-2023:4612 - (MISC) https://access.redhat.com/errata/RHSA-2023:4612 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:1513 - (MISC) https://access.redhat.com/errata/RHSA-2023:1513 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:1512 - (MISC) https://access.redhat.com/errata/RHSA-2023:1512 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:1514 - (MISC) https://access.redhat.com/errata/RHSA-2023:1514 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:3883 - (MISC) https://access.redhat.com/errata/RHSA-2023:3883 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:3954 - (MISC) https://access.redhat.com/errata/RHSA-2023:3954 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:1184 - (MISC) https://access.redhat.com/errata/RHSA-2023:1184 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:3885 - (MISC) https://access.redhat.com/errata/RHSA-2023:3885 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:1516 - (MISC) https://access.redhat.com/errata/RHSA-2023:1516 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:3892 - (MISC) https://access.redhat.com/errata/RHSA-2023:3892 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:1185 - (MISC) https://access.redhat.com/errata/RHSA-2023:1185 - Vendor Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-1108 - (MISC) https://access.redhat.com/security/cve/CVE-2023-1108 - Vendor Advisory
References (MISC) https://access.redhat.com/errata/RHSA-2023:3888 - (MISC) https://access.redhat.com/errata/RHSA-2023:3888 - Vendor Advisory
CWE CWE-835

14 Sep 2023, 18:32

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-14 15:15

Updated : 2024-11-21 07:38

NVD link : CVE-2023-1108

Mitre link : CVE-2023-1108

CVE.ORG link : CVE-2023-1108

JSON object : View

Products Affected

redhat

  • fuse
  • undertow
  • openshift_application_runtimes
  • enterprise_linux
  • jboss_enterprise_application_platform_expansion_pack
  • jboss_enterprise_application_platform
  • openshift_container_platform_for_power
  • openstack_platform
  • process_automation
  • single_sign-on
  • openshift_container_platform
  • openshift_container_platform_for_linuxone
  • integration_service_registry
  • build_of_quarkus
  • decision_manager
  • integration_camel_k

netapp

  • oncommand_workflow_automation
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')