GitHub Advisoryadvisory · Maven
GHSA-pfcc-3g6r-8rg8 Undertow client not checking server identity presented by server certificate in https connections
CRITICAL
Official page ↗
- Aliases
- CVE-2022-4492
- Ecosystem
- Maven
- Packages
- io.undertow:undertow-core
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-918
- Reviewed
- 2023-03-03
Affected packages
• Maven io.undertow:undertow-core: >= 2.3.0, < 2.3.5.Final → fixed in 2.3.5.Final
• Maven io.undertow:undertow-core: < 2.2.24.Final → fixed in 2.2.24.Final
Description
The undertow client is not checking the server identity presented by the server certificate in https connections. This should be performed by default in https and in http/2.
Related
Alias · CVE (1)
- CVE-2022-4492 The undertow client is not checking the server identity presented by the server certificate in https connections. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-4492 advisory
- https://github.com/undertow-io/undertow/pull/1447 web
- https://github.com/undertow-io/undertow/pull/1447/commits/e5071e52b72529a14d3ec436ae7102cea5d918c4 web
- https://github.com/undertow-io/undertow/pull/1457 web
- https://github.com/undertow-io/undertow/pull/1457/commits/a4d3b167126a803cc4f7fb740dd9a6ecabf59342 web
- https://access.redhat.com/security/cve/CVE-2022-4492 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2153260 web
- https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/security/impl/ClientCertAuthenticationMechanism.java web
- https://issues.redhat.com/browse/MTA-93 web
- https://issues.redhat.com/browse/UNDERTOW-2212 web
- https://security.netapp.com/advisory/ntap-20230324-0002 web