CVE-2022-24823: Local Information Disclosure Vulnerability in io.netty:netty-codec-http
First published: Fri May 06 2022(Updated: )
CVE-2021-21290 contains an incomplete fix, and this addresses the issue found in netty. When using multipart decoders in netty, local information disclosure can occur via the local system temporary directory if temporary storing of uploads on the disk is enabled.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/eap7-netty | <0:4.1.77-1.Final_redhat_00001.1.el8ea | 0:4.1.77-1.Final_redhat_00001.1.el8ea |
| redhat/eap7 | <0:1-18.el9ea | 0:1-18.el9ea |
| redhat/eap7-activemq-artemis | <0:2.16.0-9.redhat_00042.1.el9ea | 0:2.16.0-9.redhat_00042.1.el9ea |
| redhat/eap7-activemq-artemis-native | <1:1.0.2-1.redhat_00001.1.el9ea | 1:1.0.2-1.redhat_00001.1.el9ea |
| redhat/eap7-aesh-extensions | <0:1.8.0-1.redhat_00001.1.el9ea | 0:1.8.0-1.redhat_00001.1.el9ea |
| redhat/eap7-aesh-readline | <0:2.2.0-1.redhat_00001.1.el9ea | 0:2.2.0-1.redhat_00001.1.el9ea |
| redhat/eap7-agroal | <0:1.3.0-1.redhat_00001.1.el9ea | 0:1.3.0-1.redhat_00001.1.el9ea |
| redhat/eap7-antlr | <0:2.7.7-54.redhat_7.1.el9ea | 0:2.7.7-54.redhat_7.1.el9ea |
| redhat/eap7-apache-commons-beanutils | <0:1.9.4-1.redhat_00002.1.el9ea | 0:1.9.4-1.redhat_00002.1.el9ea |
| redhat/eap7-apache-commons-cli | <0:1.4.0-1.redhat_00001.1.el9ea | 0:1.4.0-1.redhat_00001.1.el9ea |
| redhat/eap7-apache-commons-codec | <0:1.15.0-1.redhat_00001.1.el9ea | 0:1.15.0-1.redhat_00001.1.el9ea |
| redhat/eap7-apache-commons-collections | <0:3.2.2-9.redhat_2.1.el9ea | 0:3.2.2-9.redhat_2.1.el9ea |
| redhat/eap7-apache-commons-io | <0:2.10.0-1.redhat_00001.1.el9ea | 0:2.10.0-1.redhat_00001.1.el9ea |
| redhat/eap7-apache-commons-lang | <0:3.11.0-1.redhat_00001.1.el9ea | 0:3.11.0-1.redhat_00001.1.el9ea |
| redhat/eap7-apache-commons-lang2 | <0:2.6.0-1.redhat_7.1.el9ea | 0:2.6.0-1.redhat_7.1.el9ea |
| redhat/eap7-apache-cxf | <0:3.3.13-1.redhat_00001.1.el9ea | 0:3.3.13-1.redhat_00001.1.el9ea |
| redhat/eap7-apache-cxf-xjc-utils | <0:3.3.1-1.1.redhat_00001.1.el9ea | 0:3.3.1-1.1.redhat_00001.1.el9ea |
| redhat/eap7-apache-mime4j | <0:0.6.0-4.1.redhat_7.1.el9ea | 0:0.6.0-4.1.redhat_7.1.el9ea |
| redhat/eap7-apache-sshd | <0:2.7.0-1.redhat_00001.1.el9ea | 0:2.7.0-1.redhat_00001.1.el9ea |
| redhat/eap7-artemis-native | <1:1.0.2-3.redhat_1.el9ea | 1:1.0.2-3.redhat_1.el9ea |
| redhat/eap7-artemis-wildfly-integration | <0:1.0.4-1.redhat_00001.1.el9ea | 0:1.0.4-1.redhat_00001.1.el9ea |
| redhat/eap7-atinject | <0:1.0.3-1.redhat_00001.1.el9ea | 0:1.0.3-1.redhat_00001.1.el9ea |
| redhat/eap7-avro | <0:1.7.6-7.1.redhat_2.1.el9ea | 0:1.7.6-7.1.redhat_2.1.el9ea |
| redhat/eap7-azure-storage | <0:8.6.6-1.1.redhat_00001.1.el9ea | 0:8.6.6-1.1.redhat_00001.1.el9ea |
| redhat/eap7-bouncycastle | <0:1.68.0-2.redhat_00005.1.el9ea | 0:1.68.0-2.redhat_00005.1.el9ea |
| redhat/eap7-byte-buddy | <0:1.11.12-2.redhat_00002.1.el9ea | 0:1.11.12-2.redhat_00002.1.el9ea |
| redhat/eap7-caffeine | <0:2.8.8-1.redhat_00001.1.el9ea | 0:2.8.8-1.redhat_00001.1.el9ea |
| redhat/eap7-cal10n | <0:0.8.1-6.redhat_1.1.el9ea | 0:0.8.1-6.redhat_1.1.el9ea |
| redhat/eap7-codehaus-jackson | <0:1.9.13-10.redhat_00007.1.el9ea | 0:1.9.13-10.redhat_00007.1.el9ea |
| redhat/eap7-commons-logging-jboss-logging | <0:1.0.0-1.Final_redhat_1.1.el9ea | 0:1.0.0-1.Final_redhat_1.1.el9ea |
| redhat/eap7-cryptacular | <0:1.2.4-1.redhat_00001.1.el9ea | 0:1.2.4-1.redhat_00001.1.el9ea |
| redhat/eap7-dom4j | <0:2.1.3-1.redhat_00001.1.el9ea | 0:2.1.3-1.redhat_00001.1.el9ea |
| redhat/eap7-ecj | <1:3.26.0-1.redhat_00002.1.el9ea | 1:3.26.0-1.redhat_00002.1.el9ea |
| redhat/eap7-eclipse-jgit | <0:5.13.0.202109080827-1.r_redhat_00001.1.el9ea | 0:5.13.0.202109080827-1.r_redhat_00001.1.el9ea |
| redhat/eap7-elytron-web | <0:1.9.2-2.Final_redhat_00001.1.el9ea | 0:1.9.2-2.Final_redhat_00001.1.el9ea |
| redhat/eap7-fge-btf | <0:1.2.0-1.redhat_00007.1.el9ea | 0:1.2.0-1.redhat_00007.1.el9ea |
| redhat/eap7-fge-msg-simple | <0:1.1.0-1.redhat_00007.1.el9ea | 0:1.1.0-1.redhat_00007.1.el9ea |
| redhat/eap7-glassfish-concurrent | <0:1.1.1-1.redhat_00001.1.el9ea | 0:1.1.1-1.redhat_00001.1.el9ea |
| redhat/eap7-glassfish-fastinfoset | <0:1.2.13-11.1.redhat_1.1.el9ea | 0:1.2.13-11.1.redhat_1.1.el9ea |
| redhat/eap7-glassfish-jaf | <0:1.2.2-1.redhat_00001.1.el9ea | 0:1.2.2-1.redhat_00001.1.el9ea |
| redhat/eap7-glassfish-javamail | <0:1.6.5-1.redhat_00001.1.el9ea | 0:1.6.5-1.redhat_00001.1.el9ea |
| redhat/eap7-glassfish-jaxb | <0:2.3.3-4.1.b02_redhat_00001.1.el9ea | 0:2.3.3-4.1.b02_redhat_00001.1.el9ea |
| redhat/eap7-glassfish-jsf | <0:2.3.14-4.SP05_redhat_00001.1.el9ea | 0:2.3.14-4.SP05_redhat_00001.1.el9ea |
| redhat/eap7-glassfish-json | <0:1.1.6-2.redhat_00001.1.el9ea | 0:1.1.6-2.redhat_00001.1.el9ea |
| redhat/eap7-gnu-getopt | <0:1.0.13-6.redhat_5.1.el9ea | 0:1.0.13-6.redhat_5.1.el9ea |
| redhat/eap7-gson | <0:2.8.9-1.redhat_00001.1.el9ea | 0:2.8.9-1.redhat_00001.1.el9ea |
| redhat/eap7-guava-failureaccess | <0:1.0.1-1.redhat_00002.1.el9ea | 0:1.0.1-1.redhat_00002.1.el9ea |
| redhat/eap7-guava-libraries | <0:30.1.0-1.1.redhat_00001.1.el9ea | 0:30.1.0-1.1.redhat_00001.1.el9ea |
| redhat/eap7-h2database | <0:1.4.197-2.redhat_00004.1.el9ea | 0:1.4.197-2.redhat_00004.1.el9ea |
| redhat/eap7-hal-console | <0:3.3.13-1.Final_redhat_00001.1.el9ea | 0:3.3.13-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-hibernate | <0:5.3.27-1.Final_redhat_00001.1.el9ea | 0:5.3.27-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-hibernate-beanvalidation-api | <0:2.0.2-1.redhat_00001.1.el9ea | 0:2.0.2-1.redhat_00001.1.el9ea |
| redhat/eap7-hibernate-commons-annotations | <0:5.0.5-1.1.Final_redhat_00002.1.el9ea | 0:5.0.5-1.1.Final_redhat_00002.1.el9ea |
| redhat/eap7-hibernate-search | <0:5.10.7-1.1.Final_redhat_00001.1.el9ea | 0:5.10.7-1.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-hibernate-validator | <0:6.0.23-1.Final_redhat_00001.1.el9ea | 0:6.0.23-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-hornetq | <0:2.4.8-1.Final_redhat_00001.1.el9ea | 0:2.4.8-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-httpcomponents-asyncclient | <0:4.1.4-1.1.redhat_00001.1.el9ea | 0:4.1.4-1.1.redhat_00001.1.el9ea |
| redhat/eap7-httpcomponents-client | <0:4.5.13-1.redhat_00001.1.el9ea | 0:4.5.13-1.redhat_00001.1.el9ea |
| redhat/eap7-httpcomponents-core | <0:4.4.14-1.redhat_00001.1.el9ea | 0:4.4.14-1.redhat_00001.1.el9ea |
| redhat/eap7-infinispan | <0:11.0.15-1.Final_redhat_00001.1.el9ea | 0:11.0.15-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-ironjacamar | <0:1.5.3-2.SP1_redhat_00001.1.el9ea | 0:1.5.3-2.SP1_redhat_00001.1.el9ea |
| redhat/eap7-jackson-annotations | <0:2.12.6-1.redhat_00001.1.el9ea | 0:2.12.6-1.redhat_00001.1.el9ea |
| redhat/eap7-jackson-core | <0:2.12.6-1.redhat_00001.1.el9ea | 0:2.12.6-1.redhat_00001.1.el9ea |
| redhat/eap7-jackson-coreutils | <0:1.8.0-1.redhat_00002.1.el9ea | 0:1.8.0-1.redhat_00002.1.el9ea |
| redhat/eap7-jackson-databind | <0:2.12.6.1-2.redhat_00004.1.el9ea | 0:2.12.6.1-2.redhat_00004.1.el9ea |
| redhat/eap7-jackson-jaxrs-providers | <0:2.12.6-1.redhat_00001.1.el9ea | 0:2.12.6-1.redhat_00001.1.el9ea |
| redhat/eap7-jackson-modules-base | <0:2.12.6-1.redhat_00001.1.el9ea | 0:2.12.6-1.redhat_00001.1.el9ea |
| redhat/eap7-jackson-modules-java8 | <0:2.12.6-1.redhat_00001.1.el9ea | 0:2.12.6-1.redhat_00001.1.el9ea |
| redhat/eap7-jakarta-el | <0:3.0.3-3.redhat_00007.1.el9ea | 0:3.0.3-3.redhat_00007.1.el9ea |
| redhat/eap7-jakarta-security-enterprise-api | <0:1.0.2-3.redhat_00001.1.el9ea | 0:1.0.2-3.redhat_00001.1.el9ea |
| redhat/eap7-jandex | <0:2.4.2-1.Final_redhat_00001.1.el9ea | 0:2.4.2-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jansi | <0:1.18.0-1.redhat_00001.1.el9ea | 0:1.18.0-1.redhat_00001.1.el9ea |
| redhat/eap7-jasypt | <0:1.9.3-1.redhat_00002.1.el9ea | 0:1.9.3-1.redhat_00002.1.el9ea |
| redhat/eap7-java-classmate | <0:1.5.1-1.redhat_00001.1.el9ea | 0:1.5.1-1.redhat_00001.1.el9ea |
| redhat/eap7-javaee-jpa-spec | <0:2.2.3-1.redhat_00001.1.el9ea | 0:2.2.3-1.redhat_00001.1.el9ea |
| redhat/eap7-javaee-security-soteria | <0:1.0.1-3.redhat_00002.1.el9ea | 0:1.0.1-3.redhat_00002.1.el9ea |
| redhat/eap7-javaewah | <0:1.1.7-1.redhat_00001.1.el9ea | 0:1.1.7-1.redhat_00001.1.el9ea |
| redhat/eap7-javapackages-tools | <0:3.4.1-5.15.6.el9ea | 0:3.4.1-5.15.6.el9ea |
| redhat/eap7-javassist | <0:3.27.0-2.GA_redhat_00001.1.el9ea | 0:3.27.0-2.GA_redhat_00001.1.el9ea |
| redhat/eap7-jaxbintros | <0:1.0.3-1.GA_redhat_00001.1.el9ea | 0:1.0.3-1.GA_redhat_00001.1.el9ea |
| redhat/eap7-jaxen | <0:1.1.6-14.redhat_2.1.el9ea | 0:1.1.6-14.redhat_2.1.el9ea |
| redhat/eap7-jberet | <0:1.3.9-2.SP2_redhat_00001.1.el9ea | 0:1.3.9-2.SP2_redhat_00001.1.el9ea |
| redhat/eap7-jboss-aesh | <0:2.4.0-1.redhat_00001.1.el9ea | 0:2.4.0-1.redhat_00001.1.el9ea |
| redhat/eap7-jboss-classfilewriter | <0:1.2.5-1.Final_redhat_00001.1.el9ea | 0:1.2.5-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-common-beans | <0:2.0.1-1.Final_redhat_00001.1.el9ea | 0:2.0.1-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-dmr | <0:1.5.1-1.Final_redhat_00001.1.el9ea | 0:1.5.1-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-ejb3-ext-api | <0:2.3.0-1.Final_redhat_00001.1.el9ea | 0:2.3.0-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-ejb-client | <0:4.0.44-1.Final_redhat_00001.1.el9ea | 0:4.0.44-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-genericjms | <0:2.0.9-1.Final_redhat_00001.1.el9ea | 0:2.0.9-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-iiop-client | <0:1.0.1-3.Final_redhat_1.1.el9ea | 0:1.0.1-3.Final_redhat_1.1.el9ea |
| redhat/eap7-jboss-invocation | <0:1.6.3-1.Final_redhat_00001.1.el9ea | 0:1.6.3-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-logging | <0:3.4.1-2.Final_redhat_00001.1.el9ea | 0:3.4.1-2.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-logmanager | <0:2.1.18-1.Final_redhat_00001.1.el9ea | 0:2.1.18-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-marshalling | <0:2.0.12-1.1.Final_redhat_00001.1.el9ea | 0:2.0.12-1.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-metadata | <0:13.0.0-1.Final_redhat_00001.1.el9ea | 0:13.0.0-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-modules | <0:1.12.0-2.Final_redhat_00001.1.el9ea | 0:1.12.0-2.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-msc | <0:1.4.12-1.Final_redhat_00001.1.el9ea | 0:1.4.12-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-openjdk-orb | <0:8.1.4-3.Final_redhat_00002.1.el9ea | 0:8.1.4-3.Final_redhat_00002.1.el9ea |
| redhat/eap7-jboss-remoting | <0:5.0.25-1.SP1_redhat_00001.1.el9ea | 0:5.0.25-1.SP1_redhat_00001.1.el9ea |
| redhat/eap7-jboss-remoting-jmx | <0:3.0.4-1.Final_redhat_00001.1.el9ea | 0:3.0.4-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-seam-int | <0:7.0.0-6.GA_redhat_2.1.el9ea | 0:7.0.0-6.GA_redhat_2.1.el9ea |
| redhat/eap7-jboss-security-negotiation | <0:3.0.6-1.Final_redhat_00001.1.el9ea | 0:3.0.6-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-security-xacml | <0:2.0.8-17.Final_redhat_8.1.el9ea | 0:2.0.8-17.Final_redhat_8.1.el9ea |
| redhat/eap7-jboss-server-migration | <0:1.10.0-18.Final_redhat_00017.1.el9ea | 0:1.10.0-18.Final_redhat_00017.1.el9ea |
| redhat/eap7-jboss-stdio | <0:1.1.0-1.Final_redhat_00001.1.el9ea | 0:1.1.0-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-threads | <0:2.4.0-1.Final_redhat_00001.1.el9ea | 0:2.4.0-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-transaction-spi | <0:7.6.0-2.Final_redhat_1.1.el9ea | 0:7.6.0-2.Final_redhat_1.1.el9ea |
| redhat/eap7-jboss-vfs | <0:3.2.16-1.Final_redhat_00001.1.el9ea | 0:3.2.16-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-weld | <3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el9ea | 3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el9ea |
| redhat/eap7-jbossws-api | <0:1.1.2-1.Final_redhat_00001.1.el9ea | 0:1.1.2-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jbossws-common | <0:3.3.3-1.Final_redhat_00001.1.el9ea | 0:3.3.3-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jbossws-common-tools | <0:1.3.2-1.Final_redhat_00001.1.el9ea | 0:1.3.2-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jbossws-cxf | <0:5.4.4-1.Final_redhat_00001.1.el9ea | 0:5.4.4-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jbossws-jaxws-undertow-httpspi | <0:1.0.1-3.Final_redhat_1.1.el9ea | 0:1.0.1-3.Final_redhat_1.1.el9ea |
| redhat/eap7-jbossws-spi | <0:3.3.1-1.Final_redhat_00001.1.el9ea | 0:3.3.1-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jboss-xnio-base | <0:3.8.7-1.SP1_redhat_00001.1.el9ea | 0:3.8.7-1.SP1_redhat_00001.1.el9ea |
| redhat/eap7-jcip-annotations | <0:1.0.0-5.redhat_8.1.el9ea | 0:1.0.0-5.redhat_8.1.el9ea |
| redhat/eap7-jctools | <0:2.1.2-1.redhat_00003.1.el9ea | 0:2.1.2-1.redhat_00003.1.el9ea |
| redhat/eap7-jettison | <0:1.4.0-1.redhat_00001.1.el9ea | 0:1.4.0-1.redhat_00001.1.el9ea |
| redhat/eap7-jgroups | <0:4.2.15-1.Final_redhat_00001.1.el9ea | 0:4.2.15-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jgroups-azure | <0:1.3.1-1.1.Final_redhat_00001.1.el9ea | 0:1.3.1-1.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-jgroups-kubernetes | <0:1.0.16-1.Final_redhat_00001.1.el9ea | 0:1.0.16-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-joda-time | <0:2.9.7-2.redhat_1.1.el9ea | 0:2.9.7-2.redhat_1.1.el9ea |
| redhat/eap7-jsonb-spec | <0:1.0.2-1.redhat_00001.1.el9ea | 0:1.0.2-1.redhat_00001.1.el9ea |
| redhat/eap7-json-patch | <0:1.9.0-1.redhat_00002.1.el9ea | 0:1.9.0-1.redhat_00002.1.el9ea |
| redhat/eap7-jsoup | <0:1.14.2-1.redhat_00002.1.el9ea | 0:1.14.2-1.redhat_00002.1.el9ea |
| redhat/eap7-jul-to-slf4j-stub | <0:1.0.1-7.Final_redhat_3.1.el9ea | 0:1.0.1-7.Final_redhat_3.1.el9ea |
| redhat/eap7-log4j | <0:2.17.1-2.redhat_00002.1.el9ea | 0:2.17.1-2.redhat_00002.1.el9ea |
| redhat/eap7-log4j2-jboss-logmanager | <0:1.0.0-1.Final_redhat_00001.1.el9ea | 0:1.0.0-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-log4j-jboss-logmanager | <0:1.2.2-1.Final_redhat_00002.1.el9ea | 0:1.2.2-1.Final_redhat_00002.1.el9ea |
| redhat/eap7-lucene-solr | <0:5.5.5-3.redhat_2.1.el9ea | 0:5.5.5-3.redhat_2.1.el9ea |
| redhat/eap7-mustache-java | <0:0.9.6-1.1.redhat_00001.1.el9ea | 0:0.9.6-1.1.redhat_00001.1.el9ea |
| redhat/eap7-narayana | <0:5.11.4-1.Final_redhat_00001.1.el9ea | 0:5.11.4-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-neethi | <0:3.1.1-1.1.redhat_1.1.el9ea | 0:3.1.1-1.1.redhat_1.1.el9ea |
| redhat/eap7-netty | <0:4.1.77-1.Final_redhat_00001.1.el9ea | 0:4.1.77-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-netty-tcnative | <0:2.0.52-1.Final_redhat_00001.1.el9ea | 0:2.0.52-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-netty-transport-native-epoll | <0:4.1.77-1.Final_redhat_00001.1.el9ea | 0:4.1.77-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-netty-xnio-transport | <0:0.1.9-1.Final_redhat_00001.1.el9ea | 0:0.1.9-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-objectweb-asm | <0:9.1.0-1.redhat_00002.1.el9ea | 0:9.1.0-1.redhat_00002.1.el9ea |
| redhat/eap7-opensaml | <0:3.3.1-1.1.redhat_00002.1.el9ea | 0:3.3.1-1.1.redhat_00002.1.el9ea |
| redhat/eap7-picketbox | <0:5.0.3-10.Final_redhat_00009.1.el9ea | 0:5.0.3-10.Final_redhat_00009.1.el9ea |
| redhat/eap7-picketbox-commons | <0:1.0.0-4.final_redhat_5.1.el9ea | 0:1.0.0-4.final_redhat_5.1.el9ea |
| redhat/eap7-picketlink-bindings | <0:2.5.5-26.SP12_redhat_00014.1.el9ea | 0:2.5.5-26.SP12_redhat_00014.1.el9ea |
| redhat/eap7-picketlink-federation | <0:2.5.5-21.SP12_redhat_00011.1.el9ea | 0:2.5.5-21.SP12_redhat_00011.1.el9ea |
| redhat/eap7-protostream | <0:4.3.5-1.Final_redhat_00001.1.el9ea | 0:4.3.5-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-reactive-streams | <0:1.0.3-2.redhat_00003.1.el9ea | 0:1.0.3-2.redhat_00003.1.el9ea |
| redhat/eap7-reactivex-rxjava | <0:3.0.9-1.redhat_00001.1.el9ea | 0:3.0.9-1.redhat_00001.1.el9ea |
| redhat/eap7-reactivex-rxjava2 | <0:2.2.20-1.redhat_00001.1.el9ea | 0:2.2.20-1.redhat_00001.1.el9ea |
| redhat/eap7-resteasy | <0:3.15.3-1.Final_redhat_00001.1.el9ea | 0:3.15.3-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-shibboleth-java-support | <0:7.3.0-1.1.redhat_00001.1.el9ea | 0:7.3.0-1.1.redhat_00001.1.el9ea |
| redhat/eap7-slf4j | <0:1.7.22-4.1.redhat_2.1.el9ea | 0:1.7.22-4.1.redhat_2.1.el9ea |
| redhat/eap7-slf4j-jboss-logmanager | <0:1.1.0-1.Final_redhat_00001.1.el9ea | 0:1.1.0-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-snakeyaml | <0:1.29.0-1.redhat_00001.2.el9ea | 0:1.29.0-1.redhat_00001.2.el9ea |
| redhat/eap7-stax2-api | <0:4.2.1-1.redhat_00001.1.el9ea | 0:4.2.1-1.redhat_00001.1.el9ea |
| redhat/eap7-stax-ex | <0:1.8.3-2.redhat_00002.1.el9ea | 0:1.8.3-2.redhat_00002.1.el9ea |
| redhat/eap7-staxmapper | <0:1.3.0-2.Final_redhat_1.1.el9ea | 0:1.3.0-2.Final_redhat_1.1.el9ea |
| redhat/eap7-sun-istack-commons | <0:3.0.10-1.1.redhat_00001.1.el9ea | 0:3.0.10-1.1.redhat_00001.1.el9ea |
| redhat/eap7-sun-saaj | <1.3-impl-0:1.3.16-18.SP1_redhat_6.1.el9ea | 1.3-impl-0:1.3.16-18.SP1_redhat_6.1.el9ea |
| redhat/eap7-sun-saaj | <1.4-impl-0:1.4.1-1.SP1_redhat_00001.1.el9ea | 1.4-impl-0:1.4.1-1.SP1_redhat_00001.1.el9ea |
| redhat/eap7-sun-ws-metadata | <2.0-api-0:1.0.0-7.MR1_redhat_8.1.el9ea | 2.0-api-0:1.0.0-7.MR1_redhat_8.1.el9ea |
| redhat/eap7-tomcat-taglibs-standard | <0:1.2.6-2.1.RC1_redhat_1.1.el9ea | 0:1.2.6-2.1.RC1_redhat_1.1.el9ea |
| redhat/eap7-undertow | <0:2.2.18-2.SP2_redhat_00001.1.el9ea | 0:2.2.18-2.SP2_redhat_00001.1.el9ea |
| redhat/eap7-undertow-jastow | <0:2.0.9-1.Final_redhat_00001.1.el9ea | 0:2.0.9-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-undertow-js | <0:1.0.2-2.Final_redhat_1.1.el9ea | 0:1.0.2-2.Final_redhat_1.1.el9ea |
| redhat/eap7-vdx | <0:1.1.6-2.redhat_1.1.el9ea | 0:1.1.6-2.redhat_1.1.el9ea |
| redhat/eap7-velocity | <0:2.3.0-1.redhat_00001.1.el9ea | 0:2.3.0-1.redhat_00001.1.el9ea |
| redhat/eap7-weld-cdi | <2.0-api-0:2.0.2-2.redhat_00002.1.el9ea | 2.0-api-0:2.0.2-2.redhat_00002.1.el9ea |
| redhat/eap7-weld-core | <0:3.1.6-1.1.Final_redhat_00001.1.el9ea | 0:3.1.6-1.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly | <0:7.4.6-5.GA_redhat_00002.1.el9ea | 0:7.4.6-5.GA_redhat_00002.1.el9ea |
| redhat/eap7-wildfly-client-config | <0:1.0.1-2.1.Final_redhat_00001.1.el9ea | 0:1.0.1-2.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-common | <0:1.5.4-1.1.Final_redhat_00001.1.el9ea | 0:1.5.4-1.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-discovery | <0:1.2.1-1.1.Final_redhat_00001.1.el9ea | 0:1.2.1-1.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-elytron | <0:1.15.13-1.Final_redhat_00001.1.el9ea | 0:1.15.13-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-http-client | <0:1.1.12-1.SP1_redhat_00001.1.el9ea | 0:1.1.12-1.SP1_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-naming-client | <0:1.0.14-1.1.Final_redhat_00001.1.el9ea | 0:1.0.14-1.1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-openssl | <0:2.2.3-1.Final_redhat_00001.1.el9ea | 0:2.2.3-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-wildfly-transaction-client | <0:1.1.15-1.Final_redhat_00001.1.el9ea | 0:1.1.15-1.Final_redhat_00001.1.el9ea |
| redhat/eap7-woodstox-core | <0:6.0.3-1.1.redhat_00001.1.el9ea | 0:6.0.3-1.1.redhat_00001.1.el9ea |
| redhat/eap7-wsdl4j | <0:1.6.3-13.redhat_2.1.el9ea | 0:1.6.3-13.redhat_2.1.el9ea |
| redhat/eap7-wss4j | <0:2.2.7-1.1.redhat_00001.1.el9ea | 0:2.2.7-1.1.redhat_00001.1.el9ea |
| redhat/eap7-xalan-j2 | <0:2.7.1-36.redhat_00013.1.el9ea | 0:2.7.1-36.redhat_00013.1.el9ea |
| redhat/eap7-xerces-j2 | <0:2.12.0-3.SP04_redhat_00001.1.el9ea | 0:2.12.0-3.SP04_redhat_00001.1.el9ea |
| redhat/eap7-xml-commons-resolver | <0:1.2.0-7.redhat_12.1.el9ea | 0:1.2.0-7.redhat_12.1.el9ea |
| redhat/eap7-xml-security | <0:2.1.7-1.1.redhat_00001.1.el9ea | 0:2.1.7-1.1.redhat_00001.1.el9ea |
| redhat/eap7-xom | <0:1.3.7-1.redhat_00001.1.el9ea | 0:1.3.7-1.redhat_00001.1.el9ea |
| redhat/eap7-yasson | <0:1.0.10-1.redhat_00001.1.el9ea | 0:1.0.10-1.redhat_00001.1.el9ea |
| redhat/eap7-netty | <0:4.1.77-1.Final_redhat_00001.1.el7ea | 0:4.1.77-1.Final_redhat_00001.1.el7ea |
| IBM Disconnected Log Collector | <=v1.0 - v1.8.2 | |
| redhat/netty | <4.1.59. | 4.1.59. |
| redhat/netty | <4.1.77. | 4.1.77. |
| Netty Netty | <4.1.77 | |
| Oracle Financial Services Crime and Compliance Management Studio | =8.0.8.2.0 | |
| Oracle Financial Services Crime and Compliance Management Studio | =8.0.8.3.0 | |
| NetApp Active IQ Unified Manager | ||
| netapp active iq unified manager windows | ||
| NetApp OnCommand Workflow Automation | ||
| NetApp SnapCenter |
Remedy
As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/225922
- https://www.ibm.com/support/pages/node/7042313 (Advisory)
- https://github.com/netty/netty/commit/185f8b2756a36aaa4f973f1a2a025e7d981823f1
- https://github.com/netty/netty/security/advisories/GHSA-269q-hmxg-m83q
- https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2
- https://security.netapp.com/advisory/ntap-20220616-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://access.redhat.com/security/cve/CVE-2021-21290
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2087548
- https://access.redhat.com/errata/RHSA-2022:5893
- https://access.redhat.com/errata/RHSA-2022:5892
- https://access.redhat.com/errata/RHSA-2022:5894
- https://access.redhat.com/errata/RHSA-2022:5928
- https://access.redhat.com/errata/RHSA-2022:6819
- https://access.redhat.com/errata/RHSA-2022:6916
- https://access.redhat.com/errata/RHSA-2022:8524
- https://access.redhat.com/errata/RHSA-2022:8652
- https://access.redhat.com/security/cve/cve-2022-24823
- https://access.redhat.com/errata/RHSA-2023:3223
- https://access.redhat.com/errata/RHSA-2023:5165
- https://bugzilla.redhat.com/show_bug.cgi?id=2087186
- https://www.cve.org/CVERecord?id=CVE-2022-24823 https://nvd.nist.gov/vuln/detail/CVE-2022-24823
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2022-24823?
CVE-2022-24823 has a severity rating of medium, indicating that it poses a moderate risk due to potential information disclosure.
How do I fix CVE-2022-24823?
To fix CVE-2022-24823, upgrade to the fixed version of the affected software packages, specifically those released after version 0:4.1.77-1.Final_redhat_00001.1.el8ea.
What systems are affected by CVE-2022-24823?
CVE-2022-24823 affects various Red Hat EAP packages, including eap7-netty and others that utilize multipart decoders.
What is local information disclosure in the context of CVE-2022-24823?
Local information disclosure refers to the unauthorized access to sensitive information stored in the local system's temporary directory due to vulnerabilities in netty.
Are there specific versions of software packages that need to be updated for CVE-2022-24823?
Yes, you need to update affected software packages to versions that include the security patches for CVE-2022-24823, especially those based on netty.
- collector/redhat-cve
- collector/ibm-support
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-24823
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/ibm
- canonical/ibm disconnected log collector
- version/ibm disconnected log collector/v1.0 - v1.8.2
- vendor/netty
- canonical/netty netty
- vendor/oracle
- canonical/oracle financial services crime and compliance management studio
- version/oracle financial services crime and compliance management studio/8.0.8.2.0
- version/oracle financial services crime and compliance management studio/8.0.8.3.0
- vendor/netapp
- canonical/netapp active iq unified manager
- canonical/netapp active iq unified manager windows
- canonical/netapp oncommand workflow automation
- canonical/netapp snapcenter