Resource exhaustion in Undertow - CVE-2024-5971

Vulnerability identifier: #VU96052

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-5971

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to response writes hand when using Java 17 TLSv1.3 NewSessionTicket. A remote attacker can perform a denial of service (DoS) attack.

Undertow
IBM Watson Knowledge Catalog in Cloud Pak for Data
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
JBoss Enterprise Application Platform
IBM Business Automation Manager Open Editions
Telco Service Activator
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
eap7-netty-xnio-transport (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-bouncycastle (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
Red Hat Camel for Spring Boot

Install updates from vendor's website.

Undertow - update to 2.2.34
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
JBoss Enterprise Application Platform - update to 7.4.18
IBM Business Automation Manager Open Editions - update to 8.0.7
eap7-netty-xnio-transport (Red Hat package) - addressed in versions 0.1.10-1.Final_redhat_00001.1.el7eap, 0.1.10-1.Final_redhat_00001.1.el8eap, 0.1.10-1.Final_redhat_00001.1.el9eap
eap7-log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.3.1-1.Final_redhat_00002.1.el7eap, 1.3.1-1.Final_redhat_00002.1.el8eap, 1.3.1-1.Final_redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.17-1.Final_redhat_00001.1.el7eap, 1.5.17-1.Final_redhat_00001.1.el8eap, 1.5.17-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-37.Final_redhat_00037.1.el7eap, 1.10.0-37.Final_redhat_00037.1.el8eap, 1.10.0-37.Final_redhat_00037.1.el9eap
eap7-bouncycastle (Red Hat package) - addressed in versions 1.78.1-1.redhat_00002.1.el7eap, 1.78.1-1.redhat_00002.1.el8eap, 1.78.1-1.redhat_00002.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.33-1.SP1_redhat_00001.1.el7eap, 2.2.33-1.SP1_redhat_00001.1.el8eap, 2.2.33-1.SP1_redhat_00001.1.el9eap
eap7-jandex (Red Hat package) - addressed in versions 2.4.5-1.Final_redhat_00001.1.el7eap, 2.4.5-1.Final_redhat_00001.1.el8eap, 2.4.5-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.23-1.Final_redhat_00001.1.el7eap, 3.3.23-1.Final_redhat_00001.1.el8eap, 3.3.23-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.16-1.Final_redhat_00001.1.el7eap, 3.8.16-1.Final_redhat_00001.1.el8eap, 3.8.16-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - addressed in versions 3.20.7, 4.4.2
eap7-netty (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.29-1.Final_redhat_00001.1.el7eap, 5.0.29-1.Final_redhat_00001.1.el8eap, 5.0.29-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.18-1.GA_redhat_00001.1.el7eap, 7.4.18-1.GA_redhat_00001.1.el8eap, 7.4.18-1.GA_redhat_00001.1.el9eap
Telco Service Activator - update to 10.1.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2292211
• https://github.com/undertow-io/undertow/releases/tag/2.2.34.Final
• https://issues.redhat.com/browse/UNDERTOW-2413

• Multiple vulnerabilities in Undertow
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.4
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 3.20
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in HPE Telco Service Activator
• Multiple vulnerabilities in IBM Watson Knowledge Catalog