Skip to content
OpenAdvisories
Medium · 6.5 CVE-2018-1114 EUVD-2022-3969GHSA-gjjx-gqm4-wcgm

Uncontrolled Resource Consumption in Undertow

Published Sep 11, 2018 · Updated Aug 5, 2024 · Assigned by redhat

Vendor: Red Hat Product: undertow Package: io.undertow:undertow-core Package: undertow Package: undertow Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

Affected products

VendorProductAffectedFixed
Red Hat undertow — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 undertow 1.4.25-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 22.04 LTS undertow No fix yet —
Ubuntu Pro 20.04 LTS undertow No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 rhvm-appliance 2:4.2-20180828.0.el7 RHSA-2018:2643
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 1.5.5.012-1.redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-commons-logging-jboss-logmanager 1.0.3-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-hibernate +5 5.1.14-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-infinispan +5 8.2.11-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.9-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-jackson-databind 2.8.11.1-1.redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-jackson-jaxrs-base +3 2.8.11-2.redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.0.10-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-jboss-marshalling +1 2.0.5-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-jboss-modules 1.6.4-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.7-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-jboss-server-migration +18 1.0.6-3.Final_redhat_3.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-12.SP11_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-undertow 1.4.18-6.SP7_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-wildfly +1 7.1.3-2.GA_redhat_2.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.1.10-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-wildfly-elytron-tool 1.0.7-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-wildfly-javadocs 7.1.3-1.GA_redhat_2.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-wildfly-naming-client 1.0.8-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-wildfly-openssl +1 1.0.6-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089
Red Hat JBoss EAP 7 eap7-wildfly-web-console-eap 2.9.17-1.Final_redhat_1.1.ep7.el6 RHSA-2018:2090, RHSA-2018:2089

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.undertow:undertow-core < 1.4.25.Final 1.4.25.Final GHSA-gjjx-gqm4-wcgm
Maven io.undertow:undertow-core >= 2.0.0.Alpha1, < 2.0.5.Final 2.0.5.Final GHSA-gjjx-gqm4-wcgm

Advisories 3

References