CVE-2023-1108: Undertow: infinite loop in sslconduit during close

First published: Tue Feb 28 2023(Updated: )

<a href="https://issues.redhat.com/browse/UNDERTOW-2239">https://issues.redhat.com/browse/UNDERTOW-2239</a> A denial-of-service vulnerability found in Undertow : Latest JDKs from the January 18th release (jdk 11.0.18, and may be jdk 17.0.6) include this change: <a href="https://github.com/openjdk/jdk11u/commit/243a55ef31e9584467482c6159501b5d522a9427#diff-fd78e578d9d538ff23130422a81e277b5482ac752dc158b6dc07737a9c4c3f4bR737-L737">https://github.com/openjdk/jdk11u/commit/243a55ef31e9584467482c6159501b5d522a9427#diff-fd78e578d9d538ff23130422a81e277b5482ac752dc158b6dc07737a9c4c3f4bR737-L737</a> Which is suspected to be the cause of an infinite loop in SslConduit here: <a href="https://github.com/undertow-io/undertow/blob/d508c1328ba5c1ca228bfcc405f2c6b9321a1139/core/src/main/java/io/undertow/protocols/ssl/SslConduit.java#L1002-L1004">https://github.com/undertow-io/undertow/blob/d508c1328ba5c1ca228bfcc405f2c6b9321a1139/core/src/main/java/io/undertow/protocols/ssl/SslConduit.java#L1002-L1004</a> Where there is HandshakeStatus.NEED_WRAP but the status is updated to Status.CLOSED (new in this JDK release) so the loop never terminates.

Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-cve
• collector/nvd-index
• agent/first-publish-date
• agent/type
• agent/weakness
• agent/author
• agent/severity
• agent/description
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2023-1108
• agent/software-canonical-lookup
• agent/title
• agent/event
• agent/softwarecombine
• collector/nvd-api
• source/NVD
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-m4mm-pg93-fv78
• agent/references
• agent/tags
• collector/nvd-cve
• collector/github-advisory
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• collector/ibm-support
• source/IBM
• package-manager/redhat
• vendor/redhat
• canonical/redhat build of quarkus
• canonical/redhat decision manager
• version/redhat decision manager/7.0
• canonical/redhat fuse
• version/redhat fuse/1.0.0
• canonical/redhat integration camel k
• canonical/redhat integration service registry
• canonical/redhat jboss enterprise application platform
• canonical/redhat jboss enterprise application platform expansion pack
• canonical/redhat openshift application runtimes
• canonical/redhat openstack platform
• version/redhat openstack platform/13.0
• canonical/redhat process automation
• version/redhat process automation/7.0
• canonical/redhat single sign-on
• canonical/redhat undertow
• version/redhat undertow/2.3.0
• canonical/redhat openshift container platform
• version/redhat openshift container platform/4.11
• version/redhat openshift container platform/4.12
• canonical/redhat openshift container platform for linuxone
• version/redhat openshift container platform for linuxone/4.9
• version/redhat openshift container platform for linuxone/4.10
• canonical/redhat openshift container platform for power
• version/redhat openshift container platform for power/4.9
• version/redhat openshift container platform for power/4.10
• canonical/redhat enterprise linux
• version/redhat enterprise linux/8.0
• version/redhat jboss enterprise application platform/7.4
• version/redhat enterprise linux/7.0
• version/redhat enterprise linux/9.0
• version/redhat single sign-on/7.6
• vendor/netapp
• canonical/netapp oncommand workflow automation
• package-manager/maven
• vendor/ibm
• canonical/ibm watson knowledge catalog on-prem
• version/ibm watson knowledge catalog on-prem/4.x