Resource exhaustion in Undertow - CVE-2022-1259

Vulnerability identifier: #VU67947

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1259

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect handling of HTTP/2 requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Note, the vulnerability exists due to an incomplete fix for #VU58177 (CVE-2021-3629).

Undertow
eap7-wildfly-http-client (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-netty-tcnative (Red Hat package)
eap7-undertow (Red Hat package)
eap7-glassfish-jsf (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-jboss-vfs (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-undertow-jastow (Red Hat package)
JBoss Enterprise Application Platform
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM InfoSphere Information Server for Cloud
IBM InfoSphere Information Server

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.13-1.SP1_redhat_00001.1.el7eap, 1.1.13-1.SP1_redhat_00001.1.el8eap, 1.1.13-1.SP1_redhat_00001.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.3-3.SP2_redhat_00001.1.el7eap, 1.5.3-3.SP2_redhat_00001.1.el8eap, 1.5.3-3.SP2_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-20.Final_redhat_00019.1.el7eap, 1.10.0-20.Final_redhat_00019.1.el8eap, 1.10.0-20.Final_redhat_00019.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.14-1.Final_redhat_00001.1.el7eap, 1.15.14-1.Final_redhat_00001.1.el8eap, 1.15.14-1.Final_redhat_00001.1.el9eap
eap7-snakeyaml (Red Hat package) - addressed in versions 1.31.0-1.redhat_00001.1.el7eap, 1.31.0-1.redhat_00001.1.el8eap, 1.31.0-1.redhat_00001.1.el9eap
eap7-netty-tcnative (Red Hat package) - addressed in versions 2.0.52-3.Final_redhat_00001.1.el7eap, 2.0.52-3.Final_redhat_00001.1.el8eap, 2.0.52-3.Final_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.19-1.SP2_redhat_00001.1.el7eap, 2.2.19-1.SP2_redhat_00001.1.el8eap, 2.2.19-1.SP2_redhat_00001.1.el9eap
eap7-glassfish-jsf (Red Hat package) - addressed in versions 2.3.14-5.SP06_redhat_00001.1.el7eap, 2.3.14-5.SP06_redhat_00001.1.el8eap, 2.3.14-5.SP06_redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-10.redhat_00045.1.el7eap, 2.16.0-10.redhat_00045.1.el8eap, 2.16.0-10.redhat_00045.1.el9eap
eap7-jboss-vfs (Red Hat package) - addressed in versions 3.2.17-1.Final_redhat_00001.1.el7eap, 3.2.17-1.Final_redhat_00001.1.el8eap, 3.2.17-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.14-1.Final_redhat_00001.1.el7eap, 3.3.14-1.Final_redhat_00001.1.el8eap, 3.3.14-1.Final_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package) - addressed in versions 3.15.4-1.Final_redhat_00001.1.el7eap, 3.15.4-1.Final_redhat_00001.1.el8eap, 3.15.4-1.Final_redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.45-1.Final_redhat_00001.1.el7eap, 4.0.45-1.Final_redhat_00001.1.el8eap, 4.0.45-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.77-3.Final_redhat_00001.1.el7eap, 4.1.77-3.Final_redhat_00001.1.el8eap, 4.1.77-3.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.77-3.Final_redhat_00001.1.el7eap, 4.1.77-3.Final_redhat_00001.1.el8eap, 4.1.77-3.Final_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package) - addressed in versions 5.3.28-1.Final_redhat_00001.1.el7eap, 5.3.28-1.Final_redhat_00001.1.el8eap, 5.3.28-1.Final_redhat_00001.1.el9eap
JBoss Enterprise Application Platform - update to 7.4.7
eap7-wildfly (Red Hat package) - addressed in versions 7.4.7-3.GA_redhat_00003.1.el7eap, 7.4.7-3.GA_redhat_00003.1.el8eap, 7.4.7-3.GA_redhat_00003.1.el9eap
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.11-1.Final_redhat_00001.1.el7eap, 2.0.11-1.Final_redhat_00001.1.el8eap, 2.0.11-1.Final_redhat_00001.1.el9eap
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM InfoSphere Information Server for Cloud - update to 11.7.1.4 Service pack 1

• https://bugzilla.redhat.com/show_bug.cgi?id=2072339

• Denial of service in Undertow
• Multiple DoS vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple DoS vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in InfoSphere Information Server
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data