CVE-2018-1114

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-111409.8The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitiCVE-2018-111419.8The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management VirtualCVE-2018-111425.5The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are aCVE-2018-111439.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).CVE-2018-111448.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).CVE-2018-111458.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).CVE-2018-111468.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).CVE-2018-111478.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).CVE-2018-111488.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).CVE-2018-111498.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).CVE-2018-11159.1postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow CVE-2018-111508.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
CVE-2018-1114: Medium severity, CVSS 6.5 | Vulnix