Input validation error in Undertow - CVE-2023-4639

Vulnerability identifier: #VU88155

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4639

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of cookies with certain value-delimiting characters in incoming requests. A remote attacker can construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification.

Undertow
IBM Watson Knowledge Catalog in Cloud Pak for Data
Migration Toolkit for Runtimes
JBoss Enterprise Application Platform
eap7-jboss-annotations (Red Hat package)
eap7-jgroups-kubernetes (Red Hat package)
eap7-jboss-cert-helper (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap7-jberet (Red Hat package)
eap7-elytron-web (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-undertow (Red Hat package)
eap8-undertow (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-lucene-solr (Red Hat package)
eap7-eclipse-jgit (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)

Install updates from vendor's website.

Undertow - addressed in versions 2.2.31, 2.3.12
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
JBoss Enterprise Application Platform - addressed in versions 7.4.16, 8.0
eap7-jboss-annotations (Red Hat package) - addressed in versions api_1.3_spec-2.0.1-3.Final_redhat_00001.1.el7eap, api_1.3_spec-2.0.1-3.Final_redhat_00001.1.el8eap, api_1.3_spec-2.0.1-3.Final_redhat_00001.1.el9eap
eap7-jgroups-kubernetes (Red Hat package) - addressed in versions 1.0.17-1.Final_redhat_00001.1.el7eap, 1.0.17-1.Final_redhat_00001.1.el8eap, 1.0.17-1.Final_redhat_00001.1.el9eap
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el7eap, 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.2-1.redhat_00001.1.el7eap, 1.1.2-1.redhat_00001.1.el8eap, 1.1.2-1.redhat_00001.1.el9eap
Migration Toolkit for Runtimes - update to 1.2.6
eap7-jberet (Red Hat package) - addressed in versions 1.3.9-3.SP3_redhat_00001.1.el7eap, 1.3.9-3.SP3_redhat_00001.1.el8eap, 1.3.9-3.SP3_redhat_00001.1.el9eap
eap7-elytron-web (Red Hat package) - addressed in versions 1.9.4-1.Final_redhat_00001.1.el7eap, 1.9.4-1.Final_redhat_00001.1.el8eap, 1.9.4-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-35.Final_redhat_00034.1.el7eap, 1.10.0-35.Final_redhat_00034.1.el8eap, 1.10.0-35.Final_redhat_00034.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.22-1.Final_redhat_00001.1.el7eap, 1.15.22-1.Final_redhat_00001.1.el8eap, 1.15.22-1.Final_redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.30-1.SP1_redhat_00001.1.el7eap, 2.2.30-1.SP1_redhat_00001.1.el8eap, 2.2.30-1.SP1_redhat_00001.1.el9eap
eap8-undertow (Red Hat package) - addressed in versions 2.3.11-1.SP1_redhat_00001.1.el8eap, 2.3.11-1.SP1_redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-18.redhat_00052.1.el7eap, 2.16.0-18.redhat_00052.1.el8eap, 2.16.0-18.redhat_00052.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.21-1.Final_redhat_00001.1.el7eap, 3.3.21-1.Final_redhat_00001.1.el8eap, 3.3.21-1.Final_redhat_00001.1.el9eap
eap7-apache-cxf (Red Hat package) - addressed in versions 3.4.10-2.redhat_00001.1.el7eap, 3.4.10-2.redhat_00001.1.el8eap, 3.4.10-2.redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.12-1.SP2_redhat_00001.1.el7eap, 3.8.12-1.SP2_redhat_00001.1.el8eap, 3.8.12-1.SP2_redhat_00001.1.el9eap
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.27-4.SP2_redhat_00001.1.el7eap, 5.0.27-4.SP2_redhat_00001.1.el8eap, 5.0.27-4.SP2_redhat_00001.1.el9eap
eap7-hibernate (Red Hat package) - addressed in versions 5.3.36-1.Final_redhat_00001.1.el7eap, 5.3.36-1.Final_redhat_00001.1.el8eap, 5.3.36-1.Final_redhat_00001.1.el9eap
eap7-lucene-solr (Red Hat package) - addressed in versions 5.5.5-6.redhat_2.1.el7eap, 5.5.5-6.redhat_2.1.el8eap, 5.5.5-6.redhat_2.1.el9eap
eap7-eclipse-jgit (Red Hat package) - addressed in versions 5.13.3.202401111512-1.r_redhat_00001.1.el7eap, 5.13.3.202401111512-1.r_redhat_00001.1.el8eap, 5.13.3.202401111512-1.r_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.4.16-4.GA_redhat_00002.1.el7eap, 7.4.16-4.GA_redhat_00002.1.el8eap, 7.4.16-4.GA_redhat_00002.1.el9eap
eap7-infinispan (Red Hat package) - addressed in versions 11.0.18-2.Final_redhat_00001.1.el7eap, 11.0.18-2.Final_redhat_00001.1.el8eap, 11.0.18-2.Final_redhat_00001.1.el9eap

• https://bugzilla.redhat.com/show_bug.cgi?id=2166022

• Multiple vulnerabilities in Undertow
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Red Hat JBoss Enterprise Application Platform update for undertow
• Multiple vulnerabilities in IBM Watson Knowledge Catalog