CVE-2023-5379

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*

History

20 Dec 2023, 18:39

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
CWE CWE-770
CPE cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
References () https://access.redhat.com/security/cve/CVE-2023-5379 - () https://access.redhat.com/security/cve/CVE-2023-5379 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:4509 - () https://access.redhat.com/errata/RHSA-2023:4509 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2242099 - () https://bugzilla.redhat.com/show_bug.cgi?id=2242099 - Issue Tracking
First Time Redhat undertow
Redhat
Redhat jboss Enterprise Application Platform
Redhat single Sign-on

13 Dec 2023, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-12-12 22:15

Updated : 2024-02-28 20:54


NVD link : CVE-2023-5379

Mitre link : CVE-2023-5379

CVE.ORG link : CVE-2023-5379


JSON object : View

Products Affected

redhat

  • jboss_enterprise_application_platform
  • single_sign-on
  • undertow
CWE
CWE-770

Allocation of Resources Without Limits or Throttling