REDHAT-BUG-2153260: Medium severity undertow vulnerability
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol. https://issues.redhat.com/browse/UNDERTOW-2212
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2153260?
The severity of REDHAT-BUG-2153260 is considered high due to the impact it may have on the security of HTTPS connections.
How do I fix REDHAT-BUG-2153260?
To fix REDHAT-BUG-2153260, ensure that your implementation of the Undertow client properly verifies the server identity presented by the server certificate.
What versions of Red Hat Undertow are affected by REDHAT-BUG-2153260?
REDHAT-BUG-2153260 affects all versions of Red Hat Undertow that do not implement server identity verification.
What happens if REDHAT-BUG-2153260 is not addressed?
If REDHAT-BUG-2153260 is not addressed, it could lead to vulnerabilities such as man-in-the-middle attacks during HTTPS connections.
Is REDHAT-BUG-2153260 related to TLS security?
Yes, REDHAT-BUG-2153260 relates directly to TLS security as it involves the verification process that is essential for secure HTTPS and HTTP/2 communications.