K73059510: Undertow vulnerabilities CVE-2019-10212 and CVE-2020-1745

Security Advisory Description CVE-2019-10212 A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files. CVE-2020-1745 A file inclusion vulnerability was found...

Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.3 security update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

club.dawdler:dawdler-boot-web-undertow (>=0.0.1-jdk1.8-releases, <=0.1.6-jdk1.8-releases), club.dawdler:dawdler-boot-web-undertow-jsp (>=0.0.1-jdk1.8-releases, <=0.1.6-jdk1.8-releases) +53 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.4.28.final)

io.undertow:undertow-core MAVEN version 1.4.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - club.dawdler:dawdler-boot-web-undertow =0.0.1-jdk1.8-releases, =0.0.1-jdk1.8-releases,...

io.inkstand:inkstand-deployment-resteasy (>=0.1.1, <=0.1.2), io.inkstand:inkstand-http-undertow (>=0.1.1, <=0.1.2) +8 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.2.0.beta3)

io.undertow:undertow-core MAVEN version 1.2.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.inkstand:inkstand-deployment-resteasy =0.1.1, =0.1.1, =0.0.1, =0.0.1, =4.0.0, =1.0.0.alpha11,...

com.opensearchserver:oss-text-extractor (1.0.0), io.undertow:undertow-servlet (1.0.17.final) +1 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.0.17.final)

io.undertow:undertow-core MAVEN version 1.0.17.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-text-extractor 1.0.0 - io.undertow:undertow-servlet 1.0.17.final -...

co.paralleluniverse:comsat-test-utils (0.2.0), io.undertow:undertow-servlet (1.1.0.beta5) +2 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.1.0.beta5)

io.undertow:undertow-core MAVEN version 1.1.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-test-utils 0.2.0 - io.undertow:undertow-servlet 1.1.0.beta5 -...

io.undertow:undertow-servlet (1.0.0.alpha8), io.undertow:undertow-websockets-jsr (1.0.0.alpha8) potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.0.0.alpha8)

io.undertow:undertow-core MAVEN version 1.0.0.alpha8 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha8 - io.undertow:undertow-websockets-jsr 1.0.0.alpha8 Source...

io.undertow:undertow-http2-test-suite (1.3.0.cr2), io.undertow:undertow-servlet (1.3.0.cr2) +52 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.3.0.cr2)

io.undertow:undertow-core MAVEN version 1.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.3.0.cr2 - io.undertow:undertow-servlet 1.3.0.cr2 -...

io.mangoo:mangooio-core (>=2.0.0-rc2, <=2.0.0-rc3), io.mangoo:mangooio-integration-test (>=2.0.0-rc2, <=2.0.0-rc3) +24 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.3.9.final)

io.undertow:undertow-core MAVEN version 1.3.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.mangoo:mangooio-core =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =2.0.0-rc2, =0.12.0, =0.12.0, =0.13.1 -...

io.undertow:undertow-servlet (1.0.0.alpha10), io.undertow:undertow-websockets-jsr (1.0.0.alpha10) potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.0.0.alpha10)

io.undertow:undertow-core MAVEN version 1.0.0.alpha10 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha10 - io.undertow:undertow-websockets-jsr 1.0.0.alpha10 Source...

com.github.jmjlbmn:huiche-demo (>=1.0.1, <=1.0.5), com.github.jmjlbmn:huiche-spring-boot-starter (>=1.0.1, <=1.0.6) +124 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.4.22.final)

io.undertow:undertow-core MAVEN version 1.4.22.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.jmjlbmn:huiche-demo =1.0.1, =1.0.1, =1.0.1.release, =0.5.0, =1.5.8, =1.3.1, =4.10.0-beta2,...

io.undertow:undertow-servlet (1.3.33.final), io.undertow:undertow-websockets-jsr (1.3.33.final) +10 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.3.33.final)

io.undertow:undertow-core MAVEN version 1.3.33.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.33.final - io.undertow:undertow-websockets-jsr 1.3.33.final -...

cn.dubby:itbus (>=0.2.7, <=0.2.8), com.github.gmcoringa:coordinator (0.0.2) +62 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.4.13.final)

io.undertow:undertow-core MAVEN version 1.4.13.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.dubby:itbus =0.2.7, =0.7.0.release, =0.7.0.release, =1.5.1, =4.4.0-rc1, =4.4.0-rc1, =4.4.0-rc1,...

de.chkal.backset:backset-core (1.0.0.alpha1), de.chkal.backset:backset-module-api (1.0.0.alpha1) +12 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.0.9.final)

io.undertow:undertow-core MAVEN version 1.0.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.chkal.backset:backset-core 1.0.0.alpha1 - de.chkal.backset:backset-module-api 1.0.0.alpha1 -...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

io.undertow:undertow-servlet (1.0.0.beta11), io.undertow:undertow-websockets-jsr (1.0.0.beta11) potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.0.0.beta11)

io.undertow:undertow-core MAVEN version 1.0.0.beta11 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta11 - io.undertow:undertow-websockets-jsr 1.0.0.beta11 Source...

com.gitblit.fathom:fathom-core (>=0.9.1, <=0.9.2), com.gitblit.fathom:fathom-eventbus (>=0.9.1, <=0.9.2) +61 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.4.3.final)

io.undertow:undertow-core MAVEN version 1.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.gitblit.fathom:fathom-core =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1, =0.9.1,...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

io.undertow:undertow-servlet (1.0.0.beta29), io.undertow:undertow-websockets-jsr (1.0.0.beta29) potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.0.0.beta29)

io.undertow:undertow-core MAVEN version 1.0.0.beta29 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.beta29 - io.undertow:undertow-websockets-jsr 1.0.0.beta29 Source...

com.fitbur.testify.examples:example-junit-springboot-systemtest (>=0.1.0, <=0.1.3), com.github.almex:raildelays-assembly-descriptor (>=2.0.0-beta.1, <=2.0.0-beta.2) +5 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.3.14.final)

io.undertow:undertow-core MAVEN version 1.3.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.fitbur.testify.examples:example-junit-springboot-systemtest =0.1.0, =2.0.0-beta.1, =2.0.0-beta.1,...