CVE-2018-1114

undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service

Severity Score

6.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

Se ha detectado que URLResource.getLastModified() en Undertow cierra los descriptores de archivo solo cuando están finalizados, lo que puede provocar el agotamiento de dichos descriptores. Esto conduce a una fuga del manejador de archivos.

Red Hat OpenShift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of RHOAR Thorntail 2.4.0 serves as a replacement for RHOAR Thorntail 2.2.0, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include code execution, denial of service, deserialization, and traversal vulnerabilities.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-12-04 CVE Reserved
2018-09-04 CVE Published
2024-08-05 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (8)

URL	Tag	Source
https://bugs.openjdk.java.net/browse/JDK-6956385	Third Party Advisory
https://issues.jboss.org/browse/UNDERTOW-1338	Issue Tracking

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2018:2643	2019-10-09
https://access.redhat.com/errata/RHSA-2018:2669	2019-10-09
https://access.redhat.com/errata/RHSA-2019:0877	2019-10-09
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1114	2019-10-09
https://access.redhat.com/security/cve/CVE-2018-1114	2019-04-24
https://bugzilla.redhat.com/show_bug.cgi?id=1573045	2019-04-24

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Undertow Search vendor "Redhat" for product "Undertow"				-		-		Affected
Redhat Search vendor "Redhat"		Virtualization Search vendor "Redhat" for product "Virtualization"				4.0 Search vendor "Redhat" for product "Virtualization" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Virtualization Search vendor "Redhat" for product "Virtualization"				4.2 Search vendor "Redhat" for product "Virtualization" and version "4.2"		-		Affected
Redhat Search vendor "Redhat"		Virtualization Host Search vendor "Redhat" for product "Virtualization Host"				4.0 Search vendor "Redhat" for product "Virtualization Host" and version "4.0"		-		Affected