OESA-2024-2419 undertow security update

Java web server using non-blocking IO Security Fixes: A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory.CVE-2023-19...

io.undertow:undertow-servlet (1.0.0.beta3), io.undertow:undertow-websockets-jsr (1.0.0.beta3) +31 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.0.0.beta3)

io.undertow:undertow-core MAVEN version 1.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta3 - io.undertow:undertow-websockets-jsr 1.0.0.beta3 -...

io.undertow:undertow-servlet (1.0.0.beta5), io.undertow:undertow-websockets-jsr (1.0.0.beta5) potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.0.0.beta5)

io.undertow:undertow-core MAVEN version 1.0.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta5 - io.undertow:undertow-websockets-jsr 1.0.0.beta5 Source cves:...

co.paralleluniverse:comsat-actors-undertow (0.1.1), io.undertow:undertow-servlet (1.0.2.final) +1 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.0.2.final)

io.undertow:undertow-core MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-actors-undertow 0.1.1 - io.undertow:undertow-servlet 1.0.2.final -...

com.github.wuic:wuic-test (>=0.5.0.rc1, <=0.5.2), io.undertow:undertow-servlet (1.0.0.final) +46 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.0.0.final)

io.undertow:undertow-core MAVEN version 1.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.wuic:wuic-test =0.5.0.rc1, =1.0.0, =1.0-alpha-2, =1.0-alpha-3, =4.0.0.alpha1, =4.0.0.alpha3 ...

io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...

io.undertow:undertow-http2-test-suite (1.3.1.final), io.undertow:undertow-servlet (1.3.1.final) +1 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.1.final)

io.undertow:undertow-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.1.final - io.undertow:undertow-servlet 1.3.1.final -...

io.undertow:undertow-http2-test-suite (1.3.0.beta10), io.undertow:undertow-servlet (1.3.0.beta10) +1 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.0.beta10)

io.undertow:undertow-core MAVEN version 1.3.0.beta10 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.beta10 - io.undertow:undertow-servlet 1.3.0.beta10 -...

io.undertow:undertow-servlet (1.0.0.alpha18), io.undertow:undertow-websockets-jsr (1.0.0.alpha18) potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.0.0.alpha18)

io.undertow:undertow-core MAVEN version 1.0.0.alpha18 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha18 - io.undertow:undertow-websockets-jsr 1.0.0.alpha18 Source...

io.undertow:undertow-servlet (1.0.0.alpha6), io.undertow:undertow-websockets-jsr (1.0.0.alpha6) potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.0.0.alpha6)

io.undertow:undertow-core MAVEN version 1.0.0.alpha6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha6 - io.undertow:undertow-websockets-jsr 1.0.0.alpha6 Source...

com.github.gmcoringa:coordinator (0.0.1), io.undertow:undertow-servlet (1.1.3.final) +4 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.1.3.final)

io.undertow:undertow-core MAVEN version 1.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.gmcoringa:coordinator 0.0.1 - io.undertow:undertow-servlet 1.1.3.final -...

io.undertow:undertow-servlet (1.1.0.cr3), io.undertow:undertow-websockets-jsr (1.1.0.cr3) potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.1.0.cr3)

io.undertow:undertow-core MAVEN version 1.1.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.cr3 - io.undertow:undertow-websockets-jsr 1.1.0.cr3 Source cves:...

io.undertow:undertow-servlet (1.1.0.cr4), io.undertow:undertow-websockets-jsr (1.1.0.cr4) potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.1.0.cr4)

io.undertow:undertow-core MAVEN version 1.1.0.cr4 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.0.cr4 - io.undertow:undertow-websockets-jsr 1.1.0.cr4 Source cves:...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

com.adobe.api.platform:micro-service-container-parent (>=1.3.0, <=1.3.7), com.fizzed:ninja-undertow (>=5.5.0.undertow1, <=5.6.0.undertow1) +52 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.22.final)

io.undertow:undertow-core MAVEN version 1.3.22.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.adobe.api.platform:micro-service-container-parent =1.3.0, =5.5.0.undertow1, =2.3.7, =2.3.8 -...

com.brinkus.labs:labs-cloud-starter-service (>=1.1.0, <=1.4.0), com.gitblit.fathom:fathom-core (0.8.4) +88 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.23.final)

io.undertow:undertow-core MAVEN version 1.3.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.brinkus.labs:labs-cloud-starter-service =1.1.0, =1.4.0 - com.gitblit.fathom:fathom-core 0.8.4 -...

app.valuationcontrol:webservice (>=0.5.0, <=0.5.1), ba.sake:sharaf_3 (>=0.0.1, <=0.7.4) +905 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (>=2.3.0.alpha1, <=2.3.12.final)

io.undertow:undertow-core MAVEN version =2.3.0.alpha1, =0.5.0, =0.0.1, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.31 and more Source cves: CVE-2023-1973 Source advisory: OSV:GHSA-97CQ-F4JM-MV8H...

io.mangoo:mangooio-core (>=2.0.0-rc2, <=2.0.0-rc3), io.mangoo:mangooio-integration-test (>=2.0.0-rc2, <=2.0.0-rc3) +24 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.9.final)

io.undertow:undertow-core MAVEN version 1.3.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.mangoo:mangooio-core =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =0.12.0, =0.12.0, =0.13.1 -...

io.silverware:http-invoker-microservice-provider (>=1.0, <=2.0), io.silverware:http-server-microservice-provider (>=1.0, <=2.0) +99 more potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.11.final)

io.undertow:undertow-core MAVEN version 1.3.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.silverware:http-invoker-microservice-provider =1.0, =1.0, =2.0.11.final, =2.0.11.final,...

io.undertow:undertow-servlet (1.3.32.final), io.undertow:undertow-websockets-jsr (1.3.32.final) potentially affected by CVE-2023-1973 via io.undertow:undertow-core (1.3.32.final)

io.undertow:undertow-core MAVEN version 1.3.32.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.32.final - io.undertow:undertow-websockets-jsr 1.3.32.final Source...