CVE-2023-1108

Q: What is the severity of CVE-2023-1108?

CVE-2023-1108 has a CVSS score of 7.5 (HIGH). CVE-2023-1108 is a denial-of-service vulnerability in Undertow's SSL/TLS implementation where an infinite loop in the handshake process can crash the server. This affects any system running vulnerable versions of Undertow, particularly web servers and applications using Undertow for HTTP/HTTPS handling.

7.5 HIGH

Denial of Service

📋 TL;DR

CVE-2023-1108 is a denial-of-service vulnerability in Undertow's SSL/TLS implementation where an infinite loop in the handshake process can crash the server. This affects any system running vulnerable versions of Undertow, particularly web servers and applications using Undertow for HTTP/HTTPS handling.

💻 Affected Systems

Products:

Undertow
Red Hat JBoss Web Server
Red Hat JBoss EAP
Applications using Undertow

Versions: Undertow versions before 2.2.27.Final and 2.3.0.Beta1

Operating Systems: Linux, Windows, All platforms running Java

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using SSL/TLS with Undertow. HTTP-only configurations are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to server crash, requiring manual restart and potentially causing extended downtime.

🟠

Likely Case

Service disruption affecting availability, with automatic restarts possible but repeated crashes leading to degraded performance.

🟢

If Mitigated

Minimal impact if patched or workarounds applied, with potential for brief service interruptions during attack attempts.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted SSL/TLS handshake requests to trigger the infinite loop.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Undertow 2.2.27.Final or 2.3.0.Beta1

Vendor Advisory: https://access.redhat.com/errata/RHSA-2023:1184

Restart Required: Yes

Instructions:

1. Identify Undertow version. 2. Update to patched version via package manager or manual installation. 3. Restart affected services. 4. Verify fix with version check.

🔧 Temporary Workarounds

Disable SSL/TLS

all

Temporarily disable SSL/TLS if HTTP-only operation is acceptable, eliminating the attack vector.

Modify server configuration to use HTTP only

Network filtering

linux

Use firewall rules to restrict SSL/TLS connections to trusted sources only.

iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

🧯 If You Can't Patch

Implement strict network segmentation to limit access to vulnerable systems
Deploy Web Application Firewall (WAF) with DoS protection rules

🔍 How to Verify

Check if Vulnerable:

Check Undertow version in application logs or via dependency management tools like Maven/Gradle.

Check Version:

grep -i undertow pom.xml || java -cp your-app.jar org.jboss.modules.Main --version

Verify Fix Applied:

Confirm Undertow version is 2.2.27.Final or higher, then test SSL/TLS connections remain stable.

📡 Detection & Monitoring

Log Indicators:

Repeated SSL handshake failures
Server process crashes with stack traces containing SslConduit
High CPU usage from Undertow threads

Network Indicators:

Abnormal SSL/TLS handshake patterns
Multiple connection attempts to SSL ports from single source

SIEM Query:

source="undertow.log" AND ("SSL" OR "handshake") AND ("error" OR "crash" OR "loop")

📊 Metadata

CVE ID: CVE-2023-1108

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

Published: September 14, 2023

Last Updated: November 21, 2024

🔗 References

https://access.redhat.com/errata/RHSA-2023:1184 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1185 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1512 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1513 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1514 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1516 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:2135
https://access.redhat.com/errata/RHSA-2023:3883 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3884 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3885 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3888 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3892 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3954 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:4612 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-1108 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2174246 Issue Tracking
https://github.com/advisories/GHSA-m4mm-pg93-fv78
https://security.netapp.com/advisory/ntap-20231020-0002/ Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:1184 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1185 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1512 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1513 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1514 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:1516 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:2135
https://access.redhat.com/errata/RHSA-2023:3883 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3884 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3885 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3888 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3892 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:3954 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:4612 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-1108 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2174246 Issue Tracking
https://github.com/advisories/GHSA-m4mm-pg93-fv78
https://security.netapp.com/advisory/ntap-20231020-0002/ Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Build Of Quarkus by Redhat

Decision Manager by Redhat

Fuse by Redhat

Integration Camel K by Redhat

Integration Service Registry by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform by Redhat

Jboss Enterprise Application Platform Expansion Pack by Redhat

Oncommand Workflow Automation by Netapp

Openshift Application Runtimes by Redhat

Openshift Container Platform by Redhat