CVE-2017-2670: High severity red hat undertow vulnerability
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
Other sources
It was found that with non-clean TCP close, Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
Vulnerable code:
https://github.com/undertow-io/undertow/blob/1.4.12.Final/core/src/main/java/io/undertow/server/protocol/framed/AbstractFramedStreamSourceChannel.java#L288
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2670?
CVE-2017-2670 is a critical vulnerability that can lead to a denial of service (DoS) due to an infinite loop in the Websocket server.
How do I fix CVE-2017-2670?
To fix CVE-2017-2670, upgrade your Undertow version to 1.3.28 or later for affected Red Hat systems and to version 2.3.8-2 for Debian systems.
Which software versions are affected by CVE-2017-2670?
CVE-2017-2670 affects Undertow versions prior to 1.3.28 and specific Red Hat JBoss Enterprise Application Platform versions.
What are the consequences of exploiting CVE-2017-2670?
Exploiting CVE-2017-2670 can lead to a denial of service condition, resulting in system unavailability.
Is CVE-2017-2670 related to TCP connections?
Yes, CVE-2017-2670 is related to non-clean TCP close operations affecting the Websocket server.