CVE-2018-1114: Medium severity redhat undertow vulnerability
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
Other sources
Undertow has a file handler leak vulnerability caused by JarURLConnection.getLastModified(). A remote attacker could exploit this to cause a denial of service.
External References:
https://issues.jboss.org/browse/UNDERTOW-1338 https://bugs.openjdk.java.net/browse/JDK-6956385
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1114?
CVE-2018-1114 has been classified as a moderate severity vulnerability due to the potential for file descriptor exhaustion.
How do I fix CVE-2018-1114?
To fix CVE-2018-1114, users should upgrade to the patched version of Undertow or Red Hat virtualization software that addresses this file handler leak issue.
What causes the vulnerability CVE-2018-1114?
CVE-2018-1114 is caused by the improper handling of file descriptors in the URLResource.getLastModified() method when using JarURLConnection.
Which software versions are affected by CVE-2018-1114?
CVE-2018-1114 affects several versions of Red Hat Undertow and Red Hat Enterprise Virtualization, specifically indicated in the vulnerability details.
Can CVE-2018-1114 be exploited remotely?
Yes, CVE-2018-1114 can potentially be exploited remotely due to its nature of leaking file handlers through URL resource requests.