What is the CVSS score of CVE-2023-1108?

CVE-2023-1108 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.8%.

Is there a patch available for CVE-2023-1108?

Yes, a patch is available for CVE-2023-1108. Update the affected software to the latest version immediately.

Build Of Quarkus CVE-2023-1108

HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2023-09-14 secalert@redhat.com

Denial Of Service Build Of Quarkus Decision Manager Fuse Integration Camel K Integration Service Registry Jboss Enterprise Application Platform Jboss Enterprise Application Platform Expansion Pack Openshift Application Runtimes Openstack Platform Process Automation Single Sign On Undertow Openshift Container Platform Openshift Container Platform For Linuxone Openshift Container Platform For Power Oncommand Workflow Automation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Sep 14, 2023 - 15:15 nvd

HIGH 7.5

DescriptionNVD

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

AnalysisAI

A flaw was found in undertow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-835. A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. Affected products include: Redhat Build Of Quarkus, Redhat Decision Manager, Redhat Fuse, Redhat Integration Camel K, Redhat Integration Service Registry.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.