GHSA-mfhv-gwf8-4m88: Medium severity Red Hat Undertow vulnerability

Q: What conditions are required to exploit this issue?

The vulnerable behavior is in Undertow's HTTP/2 handling, where the HTTP2SourceChannel can fail to write a final frame under some circumstances. Exploitation is network-reachable and requires no privileges or user interaction, but the attack complexity is rated high.

Q: What is the practical impact?

The documented impact is denial of service due to the final HTTP/2 frame not being written. Confidentiality and integrity impacts are rated none; availability is rated high.

Q: Which Undertow releases need remediation?

Affected releases are versions before 2.0.35.SP1, 2.2.6.SP1, 2.2.7.SP1, 2.0.36.SP1, 2.2.9.Final, and 2.0.39.Final. Upgrade to the applicable fixed release line or later.

Published May 24, 2022

Updated

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

Affected Software

1 affected component

Red Hat Undertow<2.0.35.SP1, <2.2.6.SP1, <2.2.7.SP1, <2.0.36.SP1, <2.2.9.Final, <2.0.39.Final

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade undertow to a version that resolves this vulnerability.
Fixed in 2.0.35.SP1
Upgrade
Upgrade undertow to a version that resolves this vulnerability.
Fixed in 2.2.6.SP1
Upgrade
Upgrade undertow to a version that resolves this vulnerability.
Fixed in 2.2.7.SP1
Upgrade
Upgrade undertow to a version that resolves this vulnerability.
Fixed in 2.0.36.SP1
Upgrade
Upgrade undertow to a version that resolves this vulnerability.
Fixed in 2.2.9.Final
Upgrade
Upgrade undertow to a version that resolves this vulnerability.
Fixed in 2.0.39.Final

Event History

May 24, 2022

CVE Published

via OSV·07:15 PM

Data Sourced

via OSV·07:15 PM

DescriptionSeverity

Frequently Asked Questions

What conditions are required to exploit this issue?

The vulnerable behavior is in Undertow's HTTP/2 handling, where the HTTP2SourceChannel can fail to write a final frame under some circumstances. Exploitation is network-reachable and requires no privileges or user interaction, but the attack complexity is rated high.

What is the practical impact?

The documented impact is denial of service due to the final HTTP/2 frame not being written. Confidentiality and integrity impacts are rated none; availability is rated high.

Which Undertow releases need remediation?

Affected releases are versions before 2.0.35.SP1, 2.2.6.SP1, 2.2.7.SP1, 2.0.36.SP1, 2.2.9.Final, and 2.0.39.Final. Upgrade to the applicable fixed release line or later.

GHSA-mfhv-gwf8-4m88: Medium severity Red Hat Undertow vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

What is the practical impact?

Which Undertow releases need remediation?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

What is the practical impact?

Which Undertow releases need remediation?