title: Infinite loop in sslconduit during close
description: A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
problem types: Loop with Unreachable Exit Condition ('Infinite Loop')
affected:
{
product: undertow
vendor: n/a
versions:
version: 2.2.24.Final, status: unaffected
version: 2.3.5.Final, status: unaffected
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: undertow
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.22-1.SP3_redhat_00002.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9]
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.9-6.GA_redhat_00004.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9]
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.23-1.SP2_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow-jastow
defaultStatus: affected
versions:
version: 0:2.0.14-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.22-1.SP3_redhat_00002.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9]
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.9-6.GA_redhat_00004.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9]
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.23-1.SP2_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow-jastow
defaultStatus: affected
versions:
version: 0:2.0.14-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.22-1.SP3_redhat_00002.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9]
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.9-6.GA_redhat_00004.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7, cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9]
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.23-1.SP2_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow-jastow
defaultStatus: affected
versions:
version: 0:2.0.14-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: undertow
cpe: cpe:/a:redhat:jboss_fuse:7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: undertow
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6.4
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.8-1.redhat_00001.1.el7sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.8-1.redhat_00001.1.el8sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.8-1.redhat_00001.1.el9sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions:
version: 7.6-24, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: Text-Only RHOAR
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: undertow
cpe: cpe:/a:redhat:openshift_application_runtimes:1.0
}
{
vendor: Red Hat
product: Red Hat build of Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:quarkus:2
}
{
vendor: Red Hat
product: Red Hat Data Grid 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_data_grid:8
}
{
vendor: Red Hat
product: Red Hat Decision Manager 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_enterprise_brms_platform:7
}
{
vendor: Red Hat
product: Red Hat Integration Camel K
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:integration:1
}
{
vendor: Red Hat
product: Red Hat Integration Camel Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:camel_quarkus:2
}
{
vendor: Red Hat
product: Red Hat Integration Service Registry
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:service_registry:2
}
{
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:jbosseapxp
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse:6
}
{
vendor: Red Hat
product: Red Hat OpenStack Platform 13 (Queens)
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:openstack:13
}
{
vendor: Red Hat
product: Red Hat Process Automation 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]