io.undertow:undertow-servlet (1.0.0.beta22), io.undertow:undertow-websockets-jsr (1.0.0.beta22) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.beta22)

io.undertow:undertow-core MAVEN version 1.0.0.beta22 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta22 - io.undertow:undertow-websockets-jsr 1.0.0.beta22 Source...

io.undertow:undertow-servlet (1.0.14.final), io.undertow:undertow-websockets-jsr (1.0.14.final) +1 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.14.final)

io.undertow:undertow-core MAVEN version 1.0.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.14.final - io.undertow:undertow-websockets-jsr 1.0.14.final -...

io.undertow:undertow-servlet (1.0.0.beta26), io.undertow:undertow-websockets-jsr (1.0.0.beta26) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.beta26)

io.undertow:undertow-core MAVEN version 1.0.0.beta26 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta26 - io.undertow:undertow-websockets-jsr 1.0.0.beta26 Source...

io.undertow:undertow-dist (1.0.0.beta15), io.undertow:undertow-servlet (1.0.0.beta15) +1 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.0.0.beta15)

io.undertow:undertow-core MAVEN version 1.0.0.beta15 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-dist 1.0.0.beta15 - io.undertow:undertow-servlet 1.0.0.beta15 -...

io.undertow:undertow-http2-test-suite (1.3.1.final), io.undertow:undertow-servlet (1.3.1.final) +1 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.1.final)

io.undertow:undertow-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.1.final - io.undertow:undertow-servlet 1.3.1.final -...

com.pep1:pep1-commons-rest (0.6), io.syndesis:http-pull-push-example (>=0.4.2, <=0.4.5) +5 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.27.final)

io.undertow:undertow-core MAVEN version 1.3.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.pep1:pep1-commons-rest 0.6 - io.syndesis:http-pull-push-example =0.4.2, =0.4.2, =0.4.2, =0.4.5 -...

io.undertow:undertow-servlet (1.1.5.final), io.undertow:undertow-websockets-jsr (1.1.5.final) potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.1.5.final)

io.undertow:undertow-core MAVEN version 1.1.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.5.final - io.undertow:undertow-websockets-jsr 1.1.5.final Source cves:...

com.github.dkubiak:goldfish-collector-maven (1.0), com.github.dkubiak:goldfish-server (1.0) +3 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.1.4.final)

io.undertow:undertow-core MAVEN version 1.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.dkubiak:goldfish-collector-maven 1.0 - com.github.dkubiak:goldfish-server 1.0 -...

io.undertow:undertow-http2-test-suite (1.2.0.beta2), io.undertow:undertow-servlet (1.2.0.beta2) +2 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.2.0.beta2)

io.undertow:undertow-core MAVEN version 1.2.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta2 - io.undertow:undertow-servlet 1.2.0.beta2 -...

io.undertow:undertow-http2-test-suite (1.3.0.cr1), io.undertow:undertow-servlet (1.3.0.cr1) +49 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.3.0.cr1)

io.undertow:undertow-core MAVEN version 1.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.cr1 - io.undertow:undertow-servlet 1.3.0.cr1 -...

io.undertow:undertow-servlet (1.4.9.final), io.undertow:undertow-websockets-jsr (1.4.9.final) +1 more potentially affected by CVE-2024-1635 via io.undertow:undertow-core (1.4.9.final)

io.undertow:undertow-core MAVEN version 1.4.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.4.9.final - io.undertow:undertow-websockets-jsr 1.4.9.final -...

CVE-2024-1342

Rejected reason: Unable to reproduce...

Cross site request forgery (csrf)

A flaw was found in OpenShift. The existing Cross-Site Request Forgery CSRF protections in place do not properly protect GET requests, allowing for the creation of WebSockets via CSRF...

CVE-2024-1342

OpenShift CSRF flaw (CVE-2024-1342): protections do not properly cover GET requests, enabling creation of WebSockets via CSRF. Affected: Red Hat OpenShift. Root cause: CSRF protection weakness for GET traffic. Impact: potential unauthorized WebSocket creation; no exploit details provided in these...

CVE-2024-21849

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-21849

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Code injection

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-21849 BIG-IP Websockets vulnerability

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2024-21849

CVE-2024-21849 affects BIG-IP with Advanced WAF/ASM configured and a Websockets profile on a virtual server. The underlying issue is that undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, leading to a DoS condition. The vulnerability is documented as affecting B...

K000135873: BIG-IP Websockets vulnerability CVE-2024-21849

Security Advisory Description When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM process to terminate. CVE-2024-21849 Impact Traffic is disrupted while the TMM process restarts...