CVE Feed

    Dashboard / CVE / CVE-2023-1108

    CVE-2023-1108

    A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

    Published:Mar 7, 2023
    Last Modified:Nov 21, 2024
    EPS:Sep 14, 2023
    EPSS Score:0.0481
    CVSS Score:7.5

    Affected Products

    Vendor
    Netapp
    Product
    Oncommand Workflow Automation
    Vendor
    Redhat
    Product
    Build Of Quarkus
    Vendor
    Redhat
    Product
    Camel Quarkus
    Vendor
    Redhat
    Product
    Decision Manager
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Fuse
    Vendor
    Redhat
    Product
    Integration
    Vendor
    Redhat
    Product
    Integration Camel K
    Vendor
    Redhat
    Product
    Integration Service Registry
    Vendor
    Redhat
    Product
    Jboss Data Grid
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Eus
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Expansion Pack
    Vendor
    Redhat
    Product
    Jboss Enterprise Bpms Platform
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jbosseapxp
    Vendor
    Redhat
    Product
    Openshift Application Runtimes
    Vendor
    Redhat
    Product
    Openshift Container Platform
    Vendor
    Redhat
    Product
    Openshift Container Platform For Linuxone
    Vendor
    Redhat
    Product
    Openshift Container Platform For Power
    Vendor
    Redhat
    Product
    Openstack
    Vendor
    Redhat
    Product
    Openstack Platform
    Vendor
    Redhat
    Product
    Process Automation
    Vendor
    Redhat
    Product
    Quarkus
    Vendor
    Redhat
    Product
    Red Hat Single Sign On
    Vendor
    Redhat
    Product
    Rhosemc
    Vendor
    Redhat
    Product
    Service Registry
    Vendor
    Redhat
    Product
    Single Sign-on
    Vendor
    Redhat
    Product
    Undertow

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-0509 (CVSS 7.3) — A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update …
    CVE-2025-21492 (CVSS 4.9) — Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions …
    CVE-2025-21502 (CVSS 4.8) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21131 (CVSS 3.7) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21140 (CVSS 4.8) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21144 (CVSS 3.7) — Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: C…
    CVE-2024-21147 (CVSS 7.4) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21138 (CVSS 3.7) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21145 (CVSS 4.8) — Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Orac…
    CVE-2024-21101 (CVSS 2.2) — Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions …

    References

    https://access.redhat.com/errata/RHSA-2023:1184
    https://access.redhat.com/errata/RHSA-2023:1185
    https://access.redhat.com/errata/RHSA-2023:1512
    https://access.redhat.com/errata/RHSA-2023:1513
    https://access.redhat.com/errata/RHSA-2023:1514
    https://access.redhat.com/errata/RHSA-2023:1516
    https://access.redhat.com/errata/RHSA-2023:2135
    https://access.redhat.com/errata/RHSA-2023:3883
    https://access.redhat.com/errata/RHSA-2023:3884
    https://access.redhat.com/errata/RHSA-2023:3885
    https://access.redhat.com/errata/RHSA-2023:3888
    https://access.redhat.com/errata/RHSA-2023:3892
    https://access.redhat.com/errata/RHSA-2023:3954
    https://access.redhat.com/errata/RHSA-2023:4612
    https://access.redhat.com/security/cve/CVE-2023-1108
    https://bugzilla.redhat.com/show_bug.cgi?id=2174246
    https://github.com/advisories/GHSA-m4mm-pg93-fv78
    https://security.netapp.com/advisory/ntap-20231020-0002/
    https://access.redhat.com/errata/RHSA-2023:1184
    https://access.redhat.com/errata/RHSA-2023:1185
    https://access.redhat.com/errata/RHSA-2023:1512
    https://access.redhat.com/errata/RHSA-2023:1513
    https://access.redhat.com/errata/RHSA-2023:1514
    https://access.redhat.com/errata/RHSA-2023:1516
    https://access.redhat.com/errata/RHSA-2023:2135
    https://access.redhat.com/errata/RHSA-2023:3883
    https://access.redhat.com/errata/RHSA-2023:3884
    https://access.redhat.com/errata/RHSA-2023:3885
    https://access.redhat.com/errata/RHSA-2023:3888
    https://access.redhat.com/errata/RHSA-2023:3892
    https://access.redhat.com/errata/RHSA-2023:3954
    https://access.redhat.com/errata/RHSA-2023:4612
    https://access.redhat.com/security/cve/CVE-2023-1108
    https://bugzilla.redhat.com/show_bug.cgi?id=2174246
    https://github.com/advisories/GHSA-m4mm-pg93-fv78
    https://security.netapp.com/advisory/ntap-20231020-0002/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High