Resource management error in Undertow - CVE-2022-2764

Vulnerability identifier: #VU69919

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2764

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in the UndertowInputStream.close() method related to EJB invocations. A remote attacker can force the application to keep the connection open and consume all available server resources.

Undertow
JBoss Enterprise Application Platform
Red Hat Single Sign-On
eap7-wildfly-naming-client (Red Hat package)
eap7-glassfish-javamail (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-undertow (Red Hat package)
eap7-glassfish-jsf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
rh-sso7-keycloak (Red Hat package)

Install updates from vendor's website.

Undertow - addressed in versions 2.2.21, 2.3.0
JBoss Enterprise Application Platform - update to 7.4.8
Red Hat Single Sign-On - update to 7.6.2
eap7-wildfly-naming-client (Red Hat package) - addressed in versions 1.0.15-1.Final_redhat_00002.1.el7eap, 1.0.15-1.Final_redhat_00002.1.el8eap, 1.0.15-1.Final_redhat_00002.1.el9eap
eap7-glassfish-javamail (Red Hat package) - addressed in versions 1.6.7-1.redhat_00001.1.el7eap, 1.6.7-1.redhat_00001.1.el8eap, 1.6.7-1.redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-21.Final_redhat_00020.1.el7eap, 1.10.0-21.Final_redhat_00020.1.el8eap, 1.10.0-21.Final_redhat_00020.1.el9eap
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.13-1.Final_redhat_00001.1.el7eap, 2.0.13-1.Final_redhat_00001.1.el8eap, 2.0.13-1.Final_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.20-1.SP1_redhat_00001.1.el7eap, 2.2.20-1.SP1_redhat_00001.1.el8eap, 2.2.20-1.SP1_redhat_00001.1.el9eap
eap7-glassfish-jsf (Red Hat package) - addressed in versions 2.3.14-6.SP07_redhat_00001.1.el7eap, 2.3.14-6.SP07_redhat_00001.1.el8eap, 2.3.14-6.SP07_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.15-1.Final_redhat_00001.1.el7eap, 3.3.15-1.Final_redhat_00001.1.el8eap, 3.3.15-1.Final_redhat_00001.1.el9eap
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.26-1.SP1_redhat_00001.1.el7eap, 5.0.26-1.SP1_redhat_00001.1.el8eap, 5.0.26-1.SP1_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.8-4.GA_redhat_00002.1.el7eap, 7.4.8-4.GA_redhat_00002.1.el8eap, 7.4.8-4.GA_redhat_00002.1.el9eap
eap7-infinispan (Red Hat package) - addressed in versions 11.0.16-1.Final_redhat_00001.1.el7eap, 11.0.16-1.Final_redhat_00001.1.el8eap, 11.0.16-1.Final_redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso

• https://bugzilla.redhat.com/show_bug.cgi?id=2117506
• https://issues.redhat.com/browse/UNDERTOW-2048

• Denial of service in Undertow
• Denial of service in Red Hat JBoss Enterprise Application Platform 7.4
• JBoss Enterprise Application Platform 7.4 for RHEL 9 update for undertow
• Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 8 update for undertow
• Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7 update for undertow
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6