CVE-2017-2670

Published: Jul 27, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

Affected (5)

Products: Redhat: Undertow, Jboss Enterprise Application Platform · Debian: Debian Linux

2 products

Jboss Enterprise Application Platform

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Undertow	Before 1.3.28

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 7.0.0
Redhat Jboss Enterprise Application Platform	Version 7.1.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0

Related CWEs

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (22)

http://rhn.redhat.com/errata/RHSA-2017-1409.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/98965

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1410

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:1411

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:1412

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3454

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3455

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3456

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3458

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2670

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://www.debian.org/security/2017/dsa-3906

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-1409.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/98965

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1410

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:1411

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:1412

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3454

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3455

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3456

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2017:3458

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2670

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://www.debian.org/security/2017/dsa-3906

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.