Information disclosure in Undertow - CVE-2024-7885

Vulnerability identifier: #VU96900

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-7885

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to insecure sharing of resources where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure.

Undertow
IBM Watson Knowledge Catalog in Cloud Pak for Data
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
JBoss Enterprise Application Platform
Wildfly Core
IBM Business Automation Manager Open Editions
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Network Slice Selection Function
eap7-jboss-server-migration (Red Hat package)
eap8-amazon-ion-java (Red Hat package)
eap7-undertow (Red Hat package)
eap8-undertow (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-netty (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Red Hat Camel for Spring Boot
IBM InfoSphere Information Server

Install updates from vendor's website.

Undertow - update to 2.3.17
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
JBoss Enterprise Application Platform - update to 7.3.16
IBM Business Automation Manager Open Editions - update to 8.0.7
Wildfly Core - update to 25.0.2
eap7-jboss-server-migration (Red Hat package) - update to 1.7.2-20.Final_redhat_00021.1.el7eap
eap8-amazon-ion-java (Red Hat package) - addressed in versions 1.11.9-2.redhat_00001.1.el8eap, 1.11.9-2.redhat_00001.1.el9eap
eap7-undertow (Red Hat package) - addressed in versions 2.0.41-6.SP7_redhat_00001.1.el7eap, 2.2.33-2.SP2_redhat_00001.1.el7eap, 2.2.33-2.SP2_redhat_00001.1.el8eap, 2.2.33-2.SP2_redhat_00001.1.el9eap
eap8-undertow (Red Hat package) - addressed in versions 2.3.14-2.SP2_redhat_00001.1.el8eap, 2.3.14-2.SP2_redhat_00001.1.el9eap
eap7-jackson-modules-java8 (Red Hat package) - update to 2.10.4-3.redhat_00008.1.el7eap
eap7-jackson-core (Red Hat package) - update to 2.10.4-4.redhat_00008.1.el7eap
eap7-jackson-jaxrs-providers (Red Hat package) - update to 2.10.4-4.redhat_00008.1.el7eap
eap7-jackson-annotations (Red Hat package) - update to 2.10.4-4.redhat_00008.1.el7eap
eap7-jackson-modules-base (Red Hat package) - update to 2.10.4-6.redhat_00008.1.el7eap
eap7-jackson-databind (Red Hat package) - update to 2.10.4-6.redhat_00008.1.el7eap
Red Hat Camel for Spring Boot - addressed in versions 3.20.7, 4.4.2
eap7-netty (Red Hat package) - update to 4.1.63-6.Final_redhat_00004.1.el7eap
eap7-wildfly (Red Hat package) - addressed in versions 7.3.16-3.GA_redhat_00003.1.el7eap, 7.4.18-1.GA_redhat_00003.1.el7eap, 7.4.18-1.GA_redhat_00003.1.el8eap, 7.4.18-1.GA_redhat_00003.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.3-13.GA_redhat_00007.1.el8eap, 8.0.3-13.GA_redhat_00007.1.el9eap
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.3.1-2.GA_redhat_00002.1.el8eap, 800.3.1-2.GA_redhat_00002.1.el9eap

• https://access.redhat.com/security/cve/CVE-2024-7885
• https://bugzilla.redhat.com/show_bug.cgi?id=2305290

• Information disclosure in Undertow
• WildFly update for Undertow
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.4
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 3.20
• Red Hat JBoss Enterprise Application Platform update for undertow
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• IBM InfoSphere Information Server update for Undertow
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3