Latest redhat undertow Vulnerabilities

● CVE-2024-1459
Undertow: directory traversal vulnerability
Redhat Undertow
maven/io.undertow:undertow-core>=2.3.0.Alpha1<2.3.12.Final
maven/io.undertow:undertow-core<2.2.31.Final
● CVE-2023-5379
Undertow: ajp request closes connection exceeding maxrequestsize
Redhat Jboss Enterprise Application Platform
Redhat Jboss Enterprise Application Platform=7.0.0
Redhat Single Sign-on=7.0
Redhat Undertow
● CVE-2023-3223
Undertow: outofmemoryerror due to @multipartconfig handling
Redhat Undertow<2.2.24
Redhat Openshift Container Platform=4.11
Redhat Openshift Container Platform=4.12
Redhat Openshift Container Platform For Ibm Linuxone=4.9
Redhat Openshift Container Platform For Ibm Linuxone=4.10
Redhat Openshift Container Platform For Power=4.9
and 43 more
● CVE-2023-1108
Undertow: infinite loop in sslconduit during close
redhat/eap7-undertow<0:2.2.22-1.SP3_redhat_00002.1.el8ea
redhat/eap7-wildfly<0:7.4.9-6.GA_redhat_00004.1.el8ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.22-1.SP3_redhat_00002.1.el9ea
redhat/eap7-wildfly<0:7.4.9-6.GA_redhat_00004.1.el9ea
and 54 more
● CVE-2022-4492
A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step ( that should at least be performe...
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el9ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el7ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el7ea
and 14 more
● CVE-2022-2764
A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK fr...
redhat/eap7-undertow<0:2.2.20-1.SP1_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.20-1.SP1_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.20-1.SP1_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el8
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el9
and 13 more
● CVE-2022-2053
When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any respons...
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el7ea
Redhat Integration Camel K
Redhat Jboss Fuse=7.0.0
Redhat Undertow<2.2.19
and 3 more
● CVE-2022-1319
A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failur...
redhat/eap7-undertow<0:2.2.17-2.SP4_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.17-2.SP4_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el8
redhat/rh-sso7<0:1-5.el9
redhat/rh-sso7-javapackages-tools<0:6.0.0-7.el9
and 16 more
● CVE-2022-1259
A flaw was found in Undertow where a potential security issue in flow control handling by browser over HTTP/2 may potentially cause overhead or DOS in the server. The highest impact of this vulnerabil...
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el7ea
IBM Watson Knowledge Catalog on-prem<=4.x
Redhat Build Of Quarkus
Redhat Integration Camel K
and 12 more
● CVE-2021-3859
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
redhat/eap7-undertow<0:2.0.41-2.SP2_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.41-2.SP2_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.41-2.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.13-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.13-1.SP2_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:15.0.4-1.redhat_00003.1.el7
and 10 more
● CVE-2021-3690
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from thi...
redhat/eap7-undertow<0:2.0.38-2.SP2_redhat_00001.1.el6ea
redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea
and 56 more
● CVE-2021-3597
A flaw was found in undertow where HTTP2SourceChannel fails to write final frame under some circumstances may result in DoS. The highest impact of this vulnerability is availability.
redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea
redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea
and 65 more
● CVE-2021-3629
A flaw was found in Undertow where a potential security issue in flow control handling by browser over HTTP/2 may potentially cause overhead or DOS in the server. The highest impact of this vulnerabil...
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea
and 50 more
● CVE-2021-20220
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid ch...
redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el6ea
redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el6ea
redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el6ea
redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el6ea
and 51 more
● CVE-2020-27782
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a d...
redhat/Undertow<2.1.5.
redhat/Undertow<2.0.33.
redhat/Undertow<2.2.3.
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea
and 60 more
● CVE-2020-10719
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request sm...
redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea
redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea
redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea
redhat/eap7-glassfish-el<0:3.0.1-5.b08_redhat_00004.1.el6ea
and 278 more
● CVE-2020-1745
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote,...
redhat/eap7-undertow<0:2.0.28-4.SP1_redhat_00002.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea
redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea
redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea
and 275 more
● CVE-2020-10705
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead t...
Redhat Undertow<2.1.1
NetApp OnCommand Insight
Redhat Jboss Enterprise Application Platform
Redhat Openshift Application Runtimes
Redhat Jboss Enterprise Application Platform=7.2
Redhat Enterprise Linux=8.0
and 269 more
● CVE-2020-10687
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid c...
Redhat Undertow<2.2.0
Redhat Jboss Enterprise Application Platform
Redhat Single Sign-on
Redhat Jboss Enterprise Application Platform=7.2
Redhat Enterprise Linux=6.0
Redhat Enterprise Linux=7.0
and 159 more
● CVE-2019-19343
A flaw was found in Undertow as shipped in Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. References: ...
redhat/undertow<2.0.25.
redhat/jboss-remoting<5.0.14.
Redhat Jboss-remoting<5.0.14
Redhat Jboss-remoting=5.0.14
Redhat Jboss Enterprise Application Platform<7.2.4
Redhat Undertow<2.0.25
and 4 more
● CVE-2019-14888
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the se...
redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea
redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea
and 80 more
● CVE-2019-10212
A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files.
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el6ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.3.7-1.Final_redhat_00001.1.el6ea
and 110 more
● CVE-2019-10184
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
maven/io.undertow:undertow-servlet<2.0.23
redhat/eap7-activemq-artemis<0:2.9.0-1.redhat_00005.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-9.redhat_00006.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-4.SP3_redhat_00002.1.el6ea
redhat/eap7-hal-console<0:3.0.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.11-2.SP1_redhat_00001.1.el6ea
and 117 more
● CVE-2019-3888
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchang...
redhat/eap7-apache-commons-codec<0:1.11.0-2.redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.2.7-2.redhat_00002.1.el6ea
redhat/eap7-hal-console<0:3.0.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.10-1.Final_redhat_00001.1.el6ea
redhat/eap7-hornetq<0:2.4.7-7.Final_redhat_2.1.el6ea
redhat/eap7-ironjacamar<0:1.4.16-2.Final_redhat_00001.1.el6ea
and 80 more
● CVE-2020-1757
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servl...
redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea
redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea
redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea
redhat/eap7-glassfish-el<0:3.0.1-5.b08_redhat_00004.1.el6ea
and 273 more
● CVE-2018-14642
An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full cont...
redhat/eap7-activemq-artemis<0:1.5.5.015-1.redhat_00001.1.ep7.el6
redhat/eap7-apache-cxf<0:3.1.16-2.redhat_2.1.ep7.el6
redhat/eap7-dom4j<0:2.1.1-1.redhat_00001.1.ep7.el6
redhat/eap7-hibernate<0:5.1.17-1.Final_redhat_00001.1.ep7.el6
redhat/eap7-ironjacamar<0:1.4.12-1.Final_redhat_00001.1.ep7.el6
redhat/eap7-jackson-databind<0:2.8.11.3-1.redhat_00001.1.ep7.el6
and 125 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203