Veracode Vulnerability DatabaseVERACODE:33457Denial Of Service (DoS)
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:N/I:N/A:P
undertow-core is vulnerable to denial of service. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service.
References
access.redhat.com/documentation/en-us/red_hat_fuse/7.10/
access.redhat.com/errata/RHSA-2021:5134
access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.10.0
access.redhat.com/security/updates/classification/#critical
access.redhat.com/security/vulnerabilities/RHSB-2021-009
bugzilla.redhat.com/show_bug.cgi?id=1970930
github.com/undertow-io/undertow/commit/33e5e59ec0924b6602119d461309c5021f66bc1c
github.com/undertow-io/undertow/commit/b92904715c5f5857827cf4201b9bce5844919259
security.netapp.com/advisory/ntap-20220804-0003/
Related
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
2.6 Low
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:N/I:N/A:P