CVE-2022-2053
First published: Fri Jun 10 2022(Updated: )
A flaw was found in Undertow. AJP requests to the server may allow an attacker to send a malicious request and trigger server errors, resulting in a denial of service.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/eap7-undertow | <0:2.2.19-1.SP2_redhat_00001.1.el8ea | 0:2.2.19-1.SP2_redhat_00001.1.el8ea |
| redhat/eap7-undertow | <0:2.2.19-1.SP2_redhat_00001.1.el9ea | 0:2.2.19-1.SP2_redhat_00001.1.el9ea |
| redhat/eap7-undertow | <0:2.2.19-1.SP2_redhat_00001.1.el7ea | 0:2.2.19-1.SP2_redhat_00001.1.el7ea |
| Redhat Integration Camel K | ||
| Redhat Jboss Fuse | =7.0.0 | |
| Redhat Undertow | <2.2.19 | |
| Redhat Undertow | =2.3.0-alpha1 | |
| redhat/undertow | <2.2.19. | 2.2.19. |
| redhat/undertow | <2.3.0. | 2.3.0. |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-2053 https://nvd.nist.gov/vuln/detail/CVE-2022-2053
- https://bugzilla.redhat.com/show_bug.cgi?id=2095862
- https://access.redhat.com/errata/RHSA-2022:6825
- https://access.redhat.com/errata/RHSA-2022:6822
- https://access.redhat.com/errata/RHSA-2022:6823
- https://access.redhat.com/errata/RHSA-2022:6821
- https://access.redhat.com/errata/RHSA-2022:8652
- https://access.redhat.com/security/cve/cve-2022-2053
- https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0
- https://issues.redhat.com/browse/UNDERTOW-2133
- https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-2053?
CVE-2022-2053 is a vulnerability in Undertow that allows an attacker to send a malicious request to the server, potentially resulting in denial of service.
How does CVE-2022-2053 impact Undertow?
CVE-2022-2053 allows an attacker to exploit a flaw in Undertow's AjpServerRequestConduit implementation to close a connection without sending any response to the client/proxy, resulting in a potential denial of service.
What is the severity of CVE-2022-2053?
CVE-2022-2053 has a severity rating of high (7 out of 10).
How can I fix CVE-2022-2053?
To fix CVE-2022-2053, it is recommended to update Undertow to version 2.2.19 or 2.3.0, depending on the affected software.
Where can I find more information about CVE-2022-2053?
You can find more information about CVE-2022-2053 in the following references: [Reference 1](https://access.redhat.com/errata/RHSA-2022:6823), [Reference 2](https://access.redhat.com/errata/RHSA-2022:6821), [Reference 3](https://access.redhat.com/errata/RHSA-2022:6822).
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/author
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2053
- agent/software-canonical-lookup
- package-manager/redhat
- vendor/redhat
- canonical/redhat integration camel k
- canonical/redhat jboss fuse
- version/redhat jboss fuse/7.0.0
- canonical/redhat undertow
- version/redhat undertow/2.3.0-alpha1