CVE-2023-1108

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-1108
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1108.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-1108
Aliases
Downstream
CLSA (1)
DEBIAN (1)
OESA (1)
RHSA (9)
UBUNTU (1)
Published
2023-09-14T14:48:58Z
Modified
2026-10-21T02:49:20Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Undertow: infinite loop in sslconduit during close
Details

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-835"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1108.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "0:2.2.22-1.SP3_redhat_00002.1.el8eap"
                        },
                        {
                            "fixed":  "0:7.4.9-6.GA_redhat_00004.1.el8eap"
                        },
                        {
                            "fixed":  "0:2.2.23-1.SP2_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed":  "0:2.0.14-1.Final_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed":  "0:2.2.22-1.SP3_redhat_00002.1.el9eap"
                        },
                        {
                            "fixed":  "0:7.4.9-6.GA_redhat_00004.1.el9eap"
                        },
                        {
                            "fixed":  "0:2.2.23-1.SP2_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed":  "0:2.0.14-1.Final_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed":  "0:2.2.22-1.SP3_redhat_00002.1.el7eap"
                        },
                        {
                            "fixed":  "0:7.4.9-6.GA_redhat_00004.1.el7eap"
                        },
                        {
                            "fixed":  "0:2.2.23-1.SP2_redhat_00001.1.el7eap"
                        },
                        {
                            "fixed":  "0:2.0.14-1.Final_redhat_00001.1.el7eap"
                        },
                        {
                            "fixed":  "0:18.0.8-1.redhat_00001.1.el7sso"
                        },
                        {
                            "fixed":  "0:18.0.8-1.redhat_00001.1.el8sso"
                        },
                        {
                            "fixed":  "0:18.0.8-1.redhat_00001.1.el9sso"
                        },
                        {
                            "fixed":  "7.6-24"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/undertow-io/undertow

Affected ranges

Type
GIT
Repo
https://github.com/undertow-io/undertow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1c15c29da4800be3189ac6dddb115d89ab27de24
Introduced
ddb772c84f8ee5ce7a803c883df313c1e2353e8a
Fixed
a55aeac10ece93b172f9175b06145d804f4b97c1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.2.24"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.3.0"
                },
                {
                    "fixed":  "2.3.5"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

1.*
1.0.0.Alpha1
1.0.0.Alpha10
1.0.0.Alpha11
1.0.0.Alpha12
1.0.0.Alpha13
1.0.0.Alpha14
1.0.0.Alpha15
1.0.0.Alpha16
1.0.0.Alpha17
1.0.0.Alpha18
1.0.0.Alpha19
1.0.0.Alpha2
1.0.0.Alpha20
1.0.0.Alpha21
1.0.0.Alpha22
1.0.0.Alpha3
1.0.0.Alpha4
1.0.0.Alpha5
1.0.0.Alpha6
1.0.0.Alpha7
1.0.0.Alpha8
1.0.0.Alpha9
1.0.0.Beta1
1.0.0.Beta10
1.0.0.Beta11
1.0.0.Beta12
1.0.0.Beta13
1.0.0.Beta14
1.0.0.Beta15
1.0.0.Beta16
1.0.0.Beta17
1.0.0.Beta18
1.0.0.Beta19
1.0.0.Beta2
1.0.0.Beta20
1.0.0.Beta21
1.0.0.Beta22
1.0.0.Beta23
1.0.0.Beta24
1.0.0.Beta25
1.0.0.Beta26
1.0.0.Beta27
1.0.0.Beta28
1.0.0.Beta29
1.0.0.Beta3
1.0.0.Beta30
1.0.0.Beta31
1.0.0.Beta32
1.0.0.Beta33
1.0.0.Beta4
1.0.0.Beta5
1.0.0.Beta6
1.0.0.Beta7
1.0.0.Beta8
1.0.0.Beta9
1.0.0.CR1
1.0.0.CR2
1.0.0.CR3
1.0.0.CR4
1.0.0.Final
1.0.1.Final
1.0.2.Final
1.0.3.Final
1.1.0.Beta1
1.1.0.Beta2
1.1.0.Beta3
1.1.0.Beta4
1.1.0.Beta5
1.1.0.Beta6
1.1.0.Beta7
1.1.0.Beta8
1.2.0.Beta1
1.2.0.Beta10
1.2.0.Beta2
1.2.0.Beta3
1.2.0.Beta4
1.2.0.Beta5
1.2.0.Beta6
1.2.0.Beta7
1.2.0.Beta8
1.2.0.Beta9
1.2.0.CR1
1.2.0.Final
1.2.1.Final
1.2.2.Final
1.2.3.Final
1.2.4.Final
1.3.0.Beta1
1.3.0.Beta10
1.3.0.Beta11
1.3.0.Beta12
1.3.0.Beta13
1.3.0.Beta2
1.3.0.Beta3
1.3.0.Beta4
1.3.0.Beta5
1.3.0.Beta6
1.3.0.Beta7
1.3.0.Beta8
1.3.0.Beta9
1.3.0.CR1
1.3.0.CR2
1.3.0.CR3
1.3.0.Final
1.3.1.Final
1.3.2.Final
1.3.3.Final
2.*
2.0.0.Alpha1
2.0.0.Beta1
2.0.0.Final
2.0.1.Final
2.0.10.Final
2.0.11.Final
2.0.12.Final
2.0.13.Final
2.0.14.Final
2.0.15.Final
2.0.16.Final
2.0.17.Final
2.0.2.Final
2.0.20.Final
2.0.21.Final
2.0.22.Final
2.0.23.Final
2.0.24.Final
2.0.25.Final
2.0.26.Final
2.0.27.Final
2.0.28.Final
2.0.29.Final
2.0.3.Final
2.0.4.Final
2.0.5.Final
2.0.6.Final
2.0.7.Final
2.0.8.Final
2.0.9.Final
2.1.0.Final
2.1.1.Final
2.1.2.Final
2.1.3.Final
2.1.4.Final
2.2.0.Final
2.2.1.Final
2.2.10.Final
2.2.11.Final
2.2.12.Final
2.2.13.Final
2.2.14.Final
2.2.15.Final
2.2.16.Final
2.2.17.Final
2.2.18.Final
2.2.19.Final
2.2.2.Final
2.2.20.Final
2.2.21.Final
2.2.22.Final
2.2.23.Final
2.2.3.Final
2.2.4.Final
2.2.5.Final
2.2.6.Final
2.2.7.Final
2.2.8.Final
2.2.9.Final
2.3.0.Final
2.3.1.Final
2.3.2.Final
2.3.3.Final
2.3.4.Final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1108.json"