Homepage

io.undertow:undertow-core@1.0.0.CR4 vulnerabilities

  • latest version

    2.3.18.Final

  • first published

    11 years ago

  • latest version published

    2 months ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the io.undertow:undertow-core package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    HTTP Request Smuggling

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to HTTP Request Smuggling due to the interaction of quotation marks and delimiters in the parseCookie() function. An attacker can exfiltrate HttpOnly cookie values or smuggle extra cookie values.

    How to fix HTTP Request Smuggling?

    Upgrade io.undertow:undertow-core to version 2.2.30.Final, 2.3.11.Final or higher.

    [,2.2.30.Final)[2.3.0.Alpha1,2.3.11.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) through the wildfly-http-client protocol, due to the WriteTimeoutStreamSinkConduit process. This vulnerability can be exploited by repeatedly opening and closing connections immediately, which triggers memory and file descriptor leaks.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.31.Final, 2.3.12.Final or higher.

    [,2.2.31.Final)[2.3.0.Final,2.3.12.Final)
    • M
    Race Condition

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Race Condition due to the reuse of the StringBuilder instance in the ProxyProtocolReadListener across multiple requests. An attacker can access data from previous requests or responses by exploiting the shared usage of the StringBuilder.

    This vulnerability primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.

    How to fix Race Condition?

    Upgrade io.undertow:undertow-core to version 2.2.36.Final, 2.3.17.Final or higher.

    [,2.2.36.Final)[2.3.0.Alpha1,2.3.17.Final)
    • L
    Memory Leak

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Memory Leak when the learning-push handler is configured with the default maxAge of -1. An attacker who can send normal HTTP requests may consume excessive memory.

    How to fix Memory Leak?

    Upgrade io.undertow:undertow-core to version 2.2.37.Final, 2.3.18.Final or higher.

    [,2.2.37.Final)[2.3.0.Alpha1,2.3.18.Final)
    • H
    Uncontrolled Recursion

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Uncontrolled Recursion in chunked response handling. An attacker can cause a client to wait indefinitely by sending excessive data without a 0\r\n termination sequence in chunked responses, thereby disrupting service to the server.

    Note: This is only exploitable when using NewSessionTicket functionality in TLS 1.3 on Java 17.

    How to fix Uncontrolled Recursion?

    Upgrade io.undertow:undertow-core to version 2.2.34.Final, 2.3.8.Final or higher.

    [,2.2.34.Final)[2.3.0.Final,2.3.8.Final)
    • M
    Directory Traversal

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Directory Traversal due to improper input validation of the HTTP request. An attacker can access privileged or restricted files and directories by appending a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP.

    How to fix Directory Traversal?

    Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.12.Final or higher.

    [,2.2.33.Final)[2.3.0.Final,2.3.12.Final)
    • H
    Uncontrolled Resource Consumption

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Uncontrolled Resource Consumption through the handling of URL-encoded request path information on ajp-listener. An attacker can cause the server to process incorrect paths, leading to a disruption of service by sending specially crafted concurrent requests.

    How to fix Uncontrolled Resource Consumption?

    Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.14.Final or higher.

    [,2.2.33.Final)[2.3.0.Final,2.3.14.Final)
    • H
    Uncontrolled Resource Consumption ('Resource Exhaustion')

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to insufficient limitations on the amount of CONTINUATION frames that can be sent within a single stream. An attacker can use up compute or memory resources to cause a disruption in service by sending packets to vulnerable servers.

    How to fix Uncontrolled Resource Consumption ('Resource Exhaustion')?

    Upgrade io.undertow:undertow-core to version 2.2.33.Final, 2.3.14.Final or higher.

    [,2.2.33.Final)[2.3.0.Final,2.3.14.Final)
    • H
    Allocation of Resources Without Limits or Throttling

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can disrupt service availability by repeatedly sending AJP requests that exceed the configured max-header-size attribute in ajp-listener, leading to the server closing the TCP connection without returning an AJP response.

    Note:

    This is only exploitable if the max-header-size is set to 64 KB or less.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade io.undertow:undertow-core to version 2.2.31.Final, 2.3.12.Final or higher.

    [,2.2.31.Final)[2.3.0.Alpha1,2.3.12.Final)
    • H
    Improper Input Validation

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Improper Input Validation via the FormAuthenticationMechanism. An attacker can exhaust the server's memory, leading to a Denial of Service by sending crafted requests that cause an OutofMemory error.

    How to fix Improper Input Validation?

    Upgrade io.undertow:undertow-core to version 2.2.32.Final, 2.3.13.Final or higher.

    [,2.2.32.Final)[2.3.0.Alpha1,2.3.13.Final)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) in flow control handling by the browser over HTTP/2. This may cause overhead or a denial of service in the server. This is due to an incomplete fix of CVE-2021-3629.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.25.Final, 2.3.6.Final or higher.

    [0,2.2.25.Final)[2.3.0.Alpha1,2.3.6.Final)
    • H
    Improper Certificate Validation

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Improper Certificate Validation via the undertow client which does not check the server identity presented by the server certificate in https connections.

    How to fix Improper Certificate Validation?

    Upgrade io.undertow:undertow-core to version 2.2.24.Final, 2.3.5.Final or higher.

    [0,2.2.24.Final)[2.3.0.Alpha1,2.3.5.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) in its use of the lastDataRead() function to manage concurrent HTTPS connections in http2/Http2Channel.java.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.0.29.Final or higher.

    [,2.0.29.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) via an AJP 400 response, when EAP 7 is improperly sending two response packets, those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.18, 2.3.0.Alpha2 or higher.

    [,2.2.18)[2.3.0.Alpha1,2.3.0.Alpha2)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) when a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize). The AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy which will result in a front-end proxy marking the backend worker as an error state and not forward requests to the worker for a while.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.19.Final, 2.3.0.Alpha2 or higher.

    [,2.2.19.Final)[2.3.0.Alpha1,2.3.0.Alpha2)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) due to an issue in the flow control handling by the browser over http/2.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.0.40.Final, 2.2.11.Final or higher.

    [,2.0.40.Final)[2.1.0.Final,2.2.11.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) which would cause client side invocation timeout with certain calls made over HTTP2.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.15.Final or higher.

    [0,2.2.15.Final)
    • M
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) due to final frame write failure in HTTP2SourceChannel under certain circumstances.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.2.8.Final or higher.

    [0,2.2.8.Final)
    • H
    HTTP Request Smuggling

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to HTTP Request Smuggling. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

    How to fix HTTP Request Smuggling?

    Upgrade io.undertow:undertow-core to version 2.1.6.Final, 2.0.34.Final or higher.

    [2.1.0.Final,2.1.6.Final)[,2.0.34.Final)
    • H
    HTTP Request Smuggling

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to HTTP Request Smuggling. A flaw was found in Undertow regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

    How to fix HTTP Request Smuggling?

    Upgrade io.undertow:undertow-core to version 2.1.1.Final or higher.

    [,2.1.1.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS). Certain requests to the "Expect: 100-continue" header may cause an out of memory error.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.1.1.Final or higher.

    [,2.1.1.Final)
    • H
    Arbitrary File Upload

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Arbitrary File Upload. A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

    How to fix Arbitrary File Upload?

    Upgrade io.undertow:undertow-core to version 2.0.30 or higher.

    [,2.0.30)
    • M
    Information Exposure

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Information Exposure via the DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user’s credentials from the log files.

    How to fix Information Exposure?

    Upgrade io.undertow:undertow-core to version 2.0.21.Final or higher.

    [,2.0.21.Final)
    • C
    Information Exposure

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Information Exposure. Confidential information such as HTTP Authentication for HttpServerExchange object at ERROR level are logged in plain text using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange) by Connectors.executeRootHandler:402.

    How to fix Information Exposure?

    Upgrade io.undertow:undertow-core to version 2.0.20.Final or higher.

    [,2.0.20.Final)
    • M
    Information Exposure

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Information Exposure. If all headers were not written out in the first write() call then the code that handles flushing the buffer would always write out the full contents of the writevBuffer buffer, which might contain data from previous requests.

    How to fix Information Exposure?

    Upgrade io.undertow:undertow-core to version 1.4.27.Final, 2.0.15.Final or higher.

    [,1.4.27.Final)[2.0.0.Final,2.0.15.Final)
    • M
    File Handler Leak

    io.undertow:undertow-core is a High performance non-blocking webserver.

    Affected versions of this package are vulnerable to File Handler Leak via the URLResource.getLastModified() method. It closes the file descriptors only when they are finalized which can cause file descriptors to exhaust.

    How to fix File Handler Leak?

    Upgrade io.undertow:undertow-core to version 2.0.5 or higher.

    [,2.0.5.Final)
    • H
    Denial of Service (DoS)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Denial of Service (DoS) attacks. Due to non-clean TCP close, the Websocket server gets into infinite loop on every IO thread.

    How to fix Denial of Service (DoS)?

    Upgrade io.undertow:undertow-core to version 2.0.0.Beta1 or higher.

    [,2.0.0.Beta1)
    • M
    CRLF Injection

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to CRLF Injection due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

    Note: this issue exists because of an incomplete fix for CVE-2016-4993

    How to fix CRLF Injection?

    Upgrade io.undertow:undertow-core to versions 1.4.25, 2.0.5 or higher.

    [,1.4.25.Final)[2.0.0.Final,2.0.5.Final)
    • M
    Man-in-the-Middle (MitM)

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Man-in-the-Middle (MitM) attacks. When using a Digest authentication, the server does not ensure that value of the URI attribute in the "Authorization" header matches URI in HTTP request line. An attacker can use this attack vector in order to access desired content on a server.

    How to fix Man-in-the-Middle (MitM)?

    Upgrade io.undertow:undertow-core to version 1.4.18.SP1, 1.4.24.Final, 2.0.2.Final or higher.

    [,1.4.18.SP1)[1.4.20.Final,1.4.24.Final)[2.0.0.Final,2.0.2.Final)
    • H
    Directory Traversal

    io.undertow:undertow-core is a Java web server based on non-blocking IO.

    Affected versions of this package are vulnerable to Directory Traversal. It does not use the ALLOW_ENCODED_SLASH option, allowing the slash characters encoded in the url. This may lead to path traversal and information disclosure of arbitrary local files.

    How to fix Directory Traversal?

    Upgrade io.undertow:undertow-core to version 2.0.0.Beta1 or higher.

    [0,2.0.0.Beta1)
    Go back to all versions of this package