CVE-2023-1108

moderate-risk
Published 2023-09-14

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Do I need to act?

-
0.57% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Integration Service Registry
Jboss Enterprise Application Platform Expansion Pack
Openshift Container Platform For Linuxone
Openshift Container Platform For Linuxone

Affected Vendors

Redhat Netapp

References (36)

Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1184
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1185
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1512
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1513
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1514
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1516
https://access.redhat.com/errata/RHSA-2023:2135
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:3883
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:3884
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:3885
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:3888
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:3892
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:3954
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:4612
Vendor Advisory https://access.redhat.com/security/cve/CVE-2023-1108
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2174246
https://github.com/advisories/GHSA-m4mm-pg93-fv78
Third Party Advisory https://security.netapp.com/advisory/ntap-20231020-0002/
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1184
Vendor Advisory https://access.redhat.com/errata/RHSA-2023:1185
and 16 more references
48
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 2/34 · Minimal
Exposure 20/34 · Moderate