CVE-2024-6162: Undertow: url-encoded request path information can be broken on ajp-listener
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
Other sources
URL-encoded request path information can be broken for concurrent requests on ajp-listener causing the wrong path to be processed ending in a possible denial of service.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.2.33.Final - Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.3.14.Final - Upgrade
Upgrade
debian/undertowto a version that resolves this vulnerability.Fixed in 2.3.18-1 - Upgrade
Upgrade
debian/undertowto a version that resolves this vulnerability.Fixed in 2.3.20-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6162?
The severity of CVE-2024-6162 is high due to potential information leakage and denial of service risks.
How do I fix CVE-2024-6162?
To fix CVE-2024-6162, upgrade your Undertow version to 2.3.14.Final or later.
What software is affected by CVE-2024-6162?
CVE-2024-6162 affects Undertow versions up to 2.2.33.Final and versions between 2.3.0.Alpha1 and 2.3.14.Final.
What are the potential impacts of CVE-2024-6162?
The potential impacts of CVE-2024-6162 include mishandling of URL-encoded request paths, leading to incorrect path information during concurrent requests.
What is Undertow in relation to CVE-2024-6162?
Undertow is a web server that is impacted by CVE-2024-6162, which shows vulnerabilities in its AJP listener handling.