high7.5
CVE-2017-2670
Moderate severity vulnerability that affects io.undertow:undertow-core
Impact
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | < 1.3.28 | 1.3.28 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Undertow | before 1.3.28 |
| Debian | Debian Linux | Version 9.0 |
| Redhat | Jboss Enterprise Application Platform | Versions 6.0.0, 7.0.0, 7.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://rhn.redhat.com/errata/RHSA-2017-1409.html
- http://www.securityfocus.com/bid/98965
- https://access.redhat.com/errata/RHSA-2017:1410
- https://access.redhat.com/errata/RHSA-2017:1411
- https://access.redhat.com/errata/RHSA-2017:1412
- https://access.redhat.com/errata/RHSA-2017:3454
- https://access.redhat.com/errata/RHSA-2017:3455
- https://access.redhat.com/errata/RHSA-2017:3456
- https://access.redhat.com/errata/RHSA-2017:3458
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2670
- https://www.debian.org/security/2017/dsa-3906
- https://github.com/advisories/GHSA-3x7h-5hfr-hvjm
- https://nvd.nist.gov/vuln/detail/CVE-2017-2670