CVE-2023-1108 Undertow: infinite loop in sslconduit during close

[
  {
    "versions": [
      {
        "status": "unaffected",
        "version": "2.3.5"
      },
      {
        "status": "unaffected",
        "version": "2.2.24"
      }
    ],
    "packageName": "io.undertow:undertow-core",
    "collectionURL": "https://github.com/undertow-io/undertow"
  },
  {
    "vendor": "Red Hat",
    "product": "EAP 7.4.10 release",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7.12",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected",
    "packageName": "undertow",
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1.0",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected",
    "packageName": "undertow",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.2.22-1.SP3_redhat_00002.1.el8eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-wildfly",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:7.4.9-6.GA_redhat_00004.1.el8eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.2.23-1.SP2_redhat_00001.1.el8eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow-jastow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.0.14-1.Final_redhat_00001.1.el8eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.2.22-1.SP3_redhat_00002.1.el9eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-wildfly",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:7.4.9-6.GA_redhat_00004.1.el9eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.2.23-1.SP2_redhat_00001.1.el9eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow-jastow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.0.14-1.Final_redhat_00001.1.el9eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.2.22-1.SP3_redhat_00002.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-wildfly",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:7.4.9-6.GA_redhat_00004.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.2.23-1.SP2_redhat_00001.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "eap7-undertow-jastow",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.0.14-1.Final_redhat_00001.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "undertow",
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6.4"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rh-sso7-keycloak",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:18.0.8-1.redhat_00001.1.el7sso",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rh-sso7-keycloak",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:18.0.8-1.redhat_00001.1.el8sso",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rh-sso7-keycloak",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:18.0.8-1.redhat_00001.1.el9sso",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat support for Spring Boot 2.7.13",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "undertow",
    "cpes": [
      "cpe:/a:redhat:openshift_application_runtimes:1.0"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "RHEL-8 based Middleware Containers",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rh-sso-7/sso76-openshift-rhel8",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "7.6-24",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:rhosemc:1.0::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "RHPAM 7.13.1 async",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "undertow",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "io.quarkus/quarkus-undertow",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:quarkus:2"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Data Grid 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "undertow",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Integration Camel K",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "undertow",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:integration:1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Integration Camel Quarkus",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "undertow",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:2"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Integration Service Registry",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "undertow",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:service_registry:2"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Data Grid 7",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "undertow",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "undertow",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Fuse 6",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "undertow",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 13 (Queens)",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "undertow",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openstack:13"
    ]
  }
]