ghsa-97cq-f4jm-mv8h
Vulnerability from github
Published
2024-11-07 12:30
Modified
2024-11-07 18:10
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.6 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
6.6 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Summary
Undertow Denial of Service vulnerability
Details
A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "io.undertow:undertow-core" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.2.32.Final" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "io.undertow:undertow-core" }, "ranges": [ { "events": [ { "introduced": "2.3.0.Alpha1" }, { "fixed": "2.3.13.Final" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2023-1973" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2024-11-07T18:10:18Z", "nvd_published_at": "2024-11-07T10:15:05Z", "severity": "MODERATE" }, "details": "A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server\u0027s memory.", "id": "GHSA-97cq-f4jm-mv8h", "modified": "2024-11-07T18:10:18Z", "published": "2024-11-07T12:30:34Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1973" }, { "type": "WEB", "url": "https://github.com/undertow-io/undertow/commit/0410f3c4d9b39b754a2203a29834cac51da11258" }, { "type": "WEB", "url": "https://github.com/undertow-io/undertow/commit/b289b18bc0ba40c134698a430c70ca1835c51d78" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1674" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1675" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1676" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1677" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:2763" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:2764" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2023-1973" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185662" }, { "type": "PACKAGE", "url": "https://github.com/undertow-io/undertow" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "type": "CVSS_V4" } ], "summary": "Undertow Denial of Service vulnerability" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.