Resource exhaustion in Undertow - CVE-2024-1635

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU88154

Resource exhaustion in Undertow - CVE-2024-1635

Published: April 4, 2024 / Updated: April 17, 2024


Vulnerability identifier: #VU88154
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-1635
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling rapidly open and closed HTTP connections. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Undertow
IBM Watson Knowledge Catalog in Cloud Pak for Data
Oracle Communications Cloud Native Core Network Repository Function
JBoss Enterprise Application Platform
Red Hat Single Sign-On
eap7-jboss-annotations (Red Hat package)
eap7-jgroups-kubernetes (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-jberet (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-lucene-solr (Red Hat package)
eap7-eclipse-jgit (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
rh-sso7-keycloak (Red Hat package)

How to mitigate CVE-2024-1635

Install updates from vendor's website.

Undertow - addressed in versions 2.2.31, 2.3.12
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
JBoss Enterprise Application Platform - update to 7.4.16
Red Hat Single Sign-On - update to 7.6.8
eap7-jboss-annotations (Red Hat package) - addressed in versions api_1.3_spec-2.0.1-3.Final_redhat_00001.1.el7eap, api_1.3_spec-2.0.1-3.Final_redhat_00001.1.el8eap, api_1.3_spec-2.0.1-3.Final_redhat_00001.1.el9eap
eap7-jgroups-kubernetes (Red Hat package) - addressed in versions 1.0.17-1.Final_redhat_00001.1.el7eap, 1.0.17-1.Final_redhat_00001.1.el8eap, 1.0.17-1.Final_redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el7eap, 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el7eap, 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap7-jberet (Red Hat package) - addressed in versions 1.3.9-3.SP3_redhat_00001.1.el7eap, 1.3.9-3.SP3_redhat_00001.1.el8eap, 1.3.9-3.SP3_redhat_00001.1.el9eap
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.4-1.Final_redhat_00001.1.el7eap, 1.9.4-1.Final_redhat_00001.1.el8eap, 1.9.4-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-35.Final_redhat_00034.1.el7eap, 1.10.0-35.Final_redhat_00034.1.el8eap, 1.10.0-35.Final_redhat_00034.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.22-1.Final_redhat_00001.1.el7eap, 1.15.22-1.Final_redhat_00001.1.el8eap, 1.15.22-1.Final_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.30-1.SP1_redhat_00001.1.el7eap, 2.2.30-1.SP1_redhat_00001.1.el8eap, 2.2.30-1.SP1_redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-18.redhat_00052.1.el7eap, 2.16.0-18.redhat_00052.1.el8eap, 2.16.0-18.redhat_00052.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.21-1.Final_redhat_00001.1.el7eap, 3.3.21-1.Final_redhat_00001.1.el8eap, 3.3.21-1.Final_redhat_00001.1.el9eap
eap7-apache-cxf (Red Hat package) - addressed in versions 3.4.10-2.redhat_00001.1.el7eap, 3.4.10-2.redhat_00001.1.el8eap, 3.4.10-2.redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.12-1.SP2_redhat_00001.1.el7eap, 3.8.12-1.SP2_redhat_00001.1.el8eap, 3.8.12-1.SP2_redhat_00001.1.el9eap
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-4.SP2_redhat_00001.1.el7eap, 5.0.27-4.SP2_redhat_00001.1.el8eap, 5.0.27-4.SP2_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package) - addressed in versions 5.3.36-1.Final_redhat_00001.1.el7eap, 5.3.36-1.Final_redhat_00001.1.el8eap, 5.3.36-1.Final_redhat_00001.1.el9eap
eap7-lucene-solr (Red Hat package) - addressed in versions 5.5.5-6.redhat_2.1.el7eap, 5.5.5-6.redhat_2.1.el8eap, 5.5.5-6.redhat_2.1.el9eap
eap7-eclipse-jgit (Red Hat package) - addressed in versions 5.13.3.202401111512-1.r_redhat_00001.1.el7eap, 5.13.3.202401111512-1.r_redhat_00001.1.el8eap, 5.13.3.202401111512-1.r_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.16-4.GA_redhat_00002.1.el7eap, 7.4.16-4.GA_redhat_00002.1.el8eap, 7.4.16-4.GA_redhat_00002.1.el9eap
eap7-infinispan (Red Hat package) - addressed in versions 11.0.18-2.Final_redhat_00001.1.el7eap, 11.0.18-2.Final_redhat_00001.1.el8eap, 11.0.18-2.Final_redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.13-1.redhat_00001.1.el7sso, 18.0.13-1.redhat_00001.1.el8sso, 18.0.13-1.redhat_00001.1.el9sso

External References

Related Security Bulletins