Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1namp4LWdxbTQtd2Nnbc4AARHF

Uncontrolled Resource Consumption in Undertow

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

Permalink: https://github.com/advisories/GHSA-gjjx-gqm4-wcgm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1namp4LWdxbTQtd2Nnbc4AARHF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-gjjx-gqm4-wcgm, CVE-2018-1114
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-1114
• https://access.redhat.com/errata/RHSA-2018:2643
• https://access.redhat.com/errata/RHSA-2018:2669
• https://access.redhat.com/errata/RHSA-2019:0877
• https://bugs.openjdk.java.net/browse/JDK-6956385
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1114
• https://issues.jboss.org/browse/UNDERTOW-1338
• https://github.com/advisories/GHSA-gjjx-gqm4-wcgm

Blast Radius: 24.2

Affected Packages