REDHAT-BUG-2272325

First published: Sat Mar 30 2024(Updated: )

Description: Product Security received a report that Undertow might incorrectly re-use an HTTP request header value from a previous stream for a request associated with a subsequent stream on the same HTTP/2 connection. The issue is linked to the readHpackString method and its interaction with the stringBuilder field. While such behavior typically results in an error followed by the termination of the HTTP/2 connection, it presents a potential vector for information leakage between requests. The original reporter referenced a similar issue in Apache Tomcat (<a href="https://access.redhat.com/security/cve/CVE-2020-17527">CVE-2020-17527</a>). In the patch for that vulnerability (<a href="https://github.com/apache/tomcat/commit/8d2fe6894d6e258a6d615d7f786acca80e6020cb">https://github.com/apache/tomcat/commit/8d2fe6894d6e258a6d615d7f786acca80e6020cb</a>) a StringBuilder field was improperly reused across multiple requests, leading to this issue. In the io.undertow.protocols.http2.HpackDecoder class of Undertow, within the readHpackString method, there is a code pattern identical to the one mentioned: ``` for (int i = 0; i &lt; length; ++i) { stringBuilder.append((char) buffer.get()); } String ret = stringBuilder.toString(); stringBuilder.setLength(0); if (ret.isEmpty()) { //return the interned empty string, rather than allocating a new one each time return ""; } ``` Steps to reproduce: No reproducers or PoC were provided, this issue was identified through static testing. Affected versions: 2.2.x, 2.3.x, and 3.x

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/description
• agent/first-publish-date
• agent/event
• agent/references
• agent/trending
• agent/source
• agent/severity
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2024-4109
• agent/last-modified-date
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/undertow
• canonical/undertow