Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05N2NxLWY0am0tbXY4aM4ABBDL

Undertow Denial of Service vulnerability

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.

Permalink: https://github.com/advisories/GHSA-97cq-f4jm-mv8h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05N2NxLWY0am0tbXY4aM4ABBDL
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 14 days ago
Updated: 14 days ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-97cq-f4jm-mv8h, CVE-2023-1973
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-1973
• https://access.redhat.com/errata/RHSA-2024:1674
• https://access.redhat.com/errata/RHSA-2024:1675
• https://access.redhat.com/errata/RHSA-2024:1676
• https://access.redhat.com/errata/RHSA-2024:1677
• https://access.redhat.com/errata/RHSA-2024:2763
• https://access.redhat.com/errata/RHSA-2024:2764
• https://access.redhat.com/security/cve/CVE-2023-1973
• https://bugzilla.redhat.com/show_bug.cgi?id=2185662
• https://github.com/undertow-io/undertow/commit/0410f3c4d9b39b754a2203a29834cac51da11258
• https://github.com/undertow-io/undertow/commit/b289b18bc0ba40c134698a430c70ca1835c51d78
• https://github.com/advisories/GHSA-97cq-f4jm-mv8h

Repository: https://github.com/undertow-io/undertow
Blast Radius: 27.9

Affected Packages