CVE-2021-3629: High severity redhat Integration vulnerability
Published Mar 29, 2021
·Updated
A flaw was found in Undertow where a potential security issue in flow control handling by browser over HTTP/2 may potentially cause overhead or DOS in the server. The highest impact of this vulnerability is availability.
Other sources
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability.
Affected Software
65 affected componentsFixes available
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea
0:3.3.12-1.redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea
0:1.5.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea
0:3.0.3-3.redhat_00007.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea
0:4.0.43-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea
0:1.7.2-10.Final_redhat_00011.1.el6ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea
0:1.14.2-1.redhat_00002.1.el6ea
redhat/eap7-resteasy<0:3.11.5-1.Final_redhat_00001.1.el6ea
0:3.11.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.41-1.SP1_redhat_00001.1.el6ea
0:2.0.41-1.SP1_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.10-2.GA_redhat_00003.1.el6ea
0:7.3.10-2.GA_redhat_00003.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.15-1.Final_redhat_00001.1.el6ea
0:1.10.15-1.Final_redhat_00001.1.el6ea
redhat/eap7-wss4j<0:2.2.7-1.redhat_00001.1.el6ea
0:2.2.7-1.redhat_00001.1.el6ea
redhat/eap7-xml-security<0:2.1.7-1.redhat_00001.1.el6ea
0:2.1.7-1.redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el7ea
0:3.3.12-1.redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el7ea
0:1.5.3-1.Final_redhat_00001.1.el7ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el7ea
0:3.0.3-3.redhat_00007.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el7ea
0:4.0.43-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el7ea
0:1.7.2-10.Final_redhat_00011.1.el7ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el7ea
0:1.14.2-1.redhat_00002.1.el7ea
redhat/eap7-resteasy<0:3.11.5-1.Final_redhat_00001.1.el7ea
0:3.11.5-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.41-1.SP1_redhat_00001.1.el7ea
0:2.0.41-1.SP1_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.10-2.GA_redhat_00003.1.el7ea
0:7.3.10-2.GA_redhat_00003.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.15-1.Final_redhat_00001.1.el7ea
0:1.10.15-1.Final_redhat_00001.1.el7ea
redhat/eap7-wss4j<0:2.2.7-1.redhat_00001.1.el7ea
0:2.2.7-1.redhat_00001.1.el7ea
redhat/eap7-xml-security<0:2.1.7-1.redhat_00001.1.el7ea
0:2.1.7-1.redhat_00001.1.el7ea
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el8ea
0:3.3.12-1.redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el8ea
0:1.5.3-1.Final_redhat_00001.1.el8ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el8ea
0:3.0.3-3.redhat_00007.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el8ea
0:4.0.43-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el8ea
0:1.7.2-10.Final_redhat_00011.1.el8ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el8ea
0:1.14.2-1.redhat_00002.1.el8ea
redhat/eap7-resteasy<0:3.11.5-1.Final_redhat_00001.1.el8ea
0:3.11.5-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.41-1.SP1_redhat_00001.1.el8ea
0:2.0.41-1.SP1_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.10-2.GA_redhat_00003.1.el8ea
0:7.3.10-2.GA_redhat_00003.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.15-1.Final_redhat_00001.1.el8ea
0:1.10.15-1.Final_redhat_00001.1.el8ea
redhat/eap7-wss4j<0:2.2.7-1.redhat_00001.1.el8ea
0:2.2.7-1.redhat_00001.1.el8ea
redhat/eap7-xml-security<0:2.1.7-1.redhat_00001.1.el8ea
0:2.1.7-1.redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.12-2.Final_redhat_00001.1.el8ea
0:2.2.12-2.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.12-2.Final_redhat_00001.1.el7ea
0:2.2.12-2.Final_redhat_00001.1.el7ea
redhat Integration
redhat JBoss Enterprise Application Platform
redhat Single Sign-on
redhat undertow<2.0.40
redhat undertow>=2.2.0<2.2.11
redhat WildFly Core<17.0
redhat JBoss Enterprise Application Platform=7.4
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat JBoss Enterprise Application Platform=7.3
redhat Enterprise Linux=6.0
NetApp Active Iq Unified Manager Linux
NetApp Active Iq Unified Manager Vmware Vsphere
NetApp Active Iq Unified Manager Windows
NetApp OnCommand Insight
NetApp OnCommand Workflow Automation
maven/io.undertow:undertow-core>=2.1.0<=2.2.10.Final
2.2.11.Final
maven/io.undertow:undertow-core<=2.0.39.Final
2.0.40.Final
All of the following
redhat JBoss Enterprise Application Platform=7.4
Any of the following
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
All of the following
redhat JBoss Enterprise Application Platform=7.3
Any of the following
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat/undertow<2.0.40.
2.0.40.
redhat/undertow<2.2.11.
2.2.11.
Event History
Mar 29, 2021
CVE Published
12:00 AM
Jun 29, 2021
Data Sourced
via Red Hat·02:11 PM
DescriptionSeverityAffected Software
May 24, 2022
CVE Published
via MITRE·06:19 PM
Data Sourced
via MITRE·06:19 PM
DescriptionWeakness
May 25, 2022
Advisory Published
via GitHub·12:00 AM
Data Sourced
via GitHub·12:00 AM
DescriptionSeverityWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
1
What is the severity of CVE-2021-3629?
The severity of CVE-2021-3629 is assessed as high due to its potential impact on system availability.
2
How do I fix CVE-2021-3629?
To fix CVE-2021-3629, you should upgrade to the latest versions of the affected packages as specified in the remediation provided by Red Hat.
3
What products are affected by CVE-2021-3629?
CVE-2021-3629 affects multiple Red Hat products including eap7-apache-cxf, eap7-ironjacamar, eap7-undertow, and others across various versions.
4
What is the nature of the vulnerability in CVE-2021-3629?
CVE-2021-3629 involves a flaw in Undertow's flow control handling over HTTP/2, potentially leading to denial-of-service (DoS) conditions.
5
When was CVE-2021-3629 published?
CVE-2021-3629 was published publicly in 2021.