7.5
CWE
400 770
Advisory Published
CVE Published
Updated

CVE-2022-1259

First published: Wed Apr 06 2022(Updated: )

A flaw was found in Undertow where a potential security issue in flow control handling by browser over HTTP/2 may potentially cause overhead or DOS in the server. The highest impact of this vulnerability is availability.(incomplete fix for <a href="https://access.redhat.com/security/cve/CVE-2021-3629">CVE-2021-3629</a>)

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el8ea
0:2.2.19-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el9ea
0:2.2.19-1.SP2_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el7ea
0:2.2.19-1.SP2_redhat_00001.1.el7ea
IBM Watson Knowledge Catalog on-prem<=4.x
Redhat Build Of Quarkus
Redhat Integration Camel K
Redhat Jboss Enterprise Application Platform=7.0.0
Redhat Openshift Application Runtimes
Redhat Single Sign-on=7.0
Redhat Undertow<=2.2.17
Redhat Undertow=2.2.18
Redhat Undertow=2.2.19
Netapp Active Iq Unified Manager Linux
Netapp Active Iq Unified Manager Vmware Vsphere
Netapp Active Iq Unified Manager Windows
Netapp Cloud Secure Agent
NetApp OnCommand Insight
NetApp OnCommand Workflow Automation

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is CVE-2022-1259?

    CVE-2022-1259 is a vulnerability in Undertow that may cause overhead or a denial of service in the server due to a potential security issue in flow control handling by the browser over HTTP/2.

  • How severe is CVE-2022-1259?

    CVE-2022-1259 has a severity score of 7.5 (high).

  • How can the CVE-2022-1259 vulnerability be fixed?

    To fix the CVE-2022-1259 vulnerability, update to version 2.2.19-1.SP2_redhat_00001.1.el8ea or higher for eap7-undertow.

  • Which software packages are affected by CVE-2022-1259?

    CVE-2022-1259 affects eap7-undertow versions 2.2.17 up to and including 2.2.19, Redhat Jboss Enterprise Application Platform 7.0.0, and other related packages.

  • What is the Common Weakness Enumeration (CWE) for CVE-2022-1259?

    The CWEs associated with CVE-2022-1259 are CWE-400: Uncontrolled Resource Consumption and CWE-770: Allocation of Resources Without Limits or Throttling.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203