CVE-2023-5379: 
JBoss EAP vulnerability analysis and mitigation

A vulnerability (CVE-2023-5379) was discovered in Undertow, affecting JBoss Enterprise Application Platform. The vulnerability was disclosed in December 2023. The flaw affects the AJP (Apache JServ Protocol) request handling mechanism in Undertow, specifically impacting systems using the ajp-listener configuration (NVD, Red Hat Advisory).

The vulnerability occurs when an AJP request exceeds the max-header-size attribute in ajp-listener configuration. When this happens, JBoss EAP closes the TCP connection without returning an AJP response, causing mod_cluster in httpd to mark the JBoss EAP instance as an error worker. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a Denial of Service (DoS) condition. When exploited, it causes mod_proxy_cluster to mark the JBoss EAP instance as an error worker and stop forwarding requests, effectively making the service unavailable (Red Hat Bugzilla).

The vulnerability can be exploited by repeatedly sending requests that exceed the max-header-size. The attack requires no special privileges or user interaction, making it relatively straightforward to exploit. An attacker can trigger the vulnerability remotely through network access (NVD).

Red Hat has released security updates to address this vulnerability in JBoss Enterprise Application Platform 7.4.12. Users are advised to update to the latest version to mitigate this security issue (Red Hat Advisory).