CVE-2019-19343
First published: Fri Dec 06 2019(Updated: )
A flaw was found in Undertow as shipped in Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. References: <a href="https://issues.redhat.com/browse/JBEAP-16695">https://issues.redhat.com/browse/JBEAP-16695</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/undertow | <2.0.25. | 2.0.25. |
| redhat/jboss-remoting | <5.0.14. | 5.0.14. |
| Redhat Jboss-remoting | <5.0.14 | |
| Redhat Jboss-remoting | =5.0.14 | |
| Red Hat JBoss Enterprise Application Platform | <7.2.4 | |
| Redhat Undertow | <2.0.25 | |
| Redhat Undertow | =2.0.25 | |
| Netapp Active Iq Unified Manager Linux | ||
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Vsphere |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1780445
- https://issues.redhat.com/browse/JBEAP-16695
- https://security.netapp.com/advisory/ntap-20220211-0002/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1780446
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1780445#c7
- https://issues.redhat.com/browse/REM3-347
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1780445#c10
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1780445#c11
- https://access.redhat.com/errata/RHSA-2020:2565
- https://access.redhat.com/security/cve/cve-2019-19343
- https://access.redhat.com/errata/RHSA-2020:5568
- https://www.cve.org/CVERecord?id=CVE-2019-19343 https://nvd.nist.gov/vuln/detail/CVE-2019-19343
- https://access.redhat.com/errata/RHSA-2019:2938
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2019-19343?
CVE-2019-19343 is a vulnerability found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4.
What is the severity of CVE-2019-19343?
The severity of CVE-2019-19343 is medium, with a CVSS score of 5.9.
How does CVE-2019-19343 affect software?
CVE-2019-19343 affects Undertow versions before 2.0.25.SP1 and jboss-remoting versions before 5.0.14.SP1.
What is the impact of CVE-2019-19343?
CVE-2019-19343 can lead to a denial of service due to a memory leak in HttpOpenListener.
How can CVE-2019-19343 be fixed?
To fix CVE-2019-19343, upgrade to Undertow version 2.0.25.SP1 or later, and jboss-remoting version 5.0.14.SP1 or later.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/author
- agent/severity
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-19343
- agent/software-canonical-lookup
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/redhat
- canonical/redhat jboss-remoting
- version/redhat jboss-remoting/5.0.14
- canonical/red hat jboss enterprise application platform
- canonical/redhat undertow
- version/redhat undertow/2.0.25
- vendor/netapp
- canonical/netapp active iq unified manager linux
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager vsphere