Bug 2242099 (CVE-2023-5379) - CVE-2023-5379 undertow: AJP Request closes connection exceeding maxRequestSize
Summary: CVE-2023-5379 undertow: AJP Request closes connection exceeding maxRequestSize
Keywords:
Status: NEW
Alias: CVE-2023-5379
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2238749
TreeView+ depends on / blocked
 
Reported: 2023-10-04 11:53 UTC by Patrick Del Bello
Modified: 2024-05-03 18:49 UTC (History)
64 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Patrick Del Bello 2023-10-04 11:53:33 UTC 
When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked as an error state by mod_cluster in httpd. The problem is that requests exceeding the max-header-size cause JBoss EAP to close the TCP connection without returning an AJP response.

A malicious user could exploit this behavior by repeatedly sending requests that exceed the max-header-size, it causes a denial-of-service attack. This is because mod_proxy_cluster marks JBoss instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding.
Note You need to log in before you can comment on or make changes to this bug.