PT-2023-14569 · Undertow · Undertow

Sandipan Roy · Publicado 2023-02-23 · Atualizado 2025-03-12 · CVE-2022-4492

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description The undertow client does not check the server identity presented by the server certificate in https connections, which is a compulsory step that should be performed by default in https and http/2. This issue affects the TLS client protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2022-4492

GHSA-PFCC-3G6R-8RG8

RHSA-2023:1512

RHSA-2023:1513

RHSA-2023:1514

RHSA-2023:2705

RHSA-2023:2706

RHSA-2023:2707

RHSA-2025:9582

RHSA-2025:9583

Produtos afetados

Undertow

Referências · 21

• https://github.com/undertow-io/undertow/pull/1447/commits/e5071e52b72529a14d3ec436ae7102cea5d918c4 · Nota
• https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/security/impl/ClientCertAuthenticationMechanism.java · Nota
• https://github.com/undertow-io/undertow/pull/1457 · Nota
• https://github.com/undertow-io/undertow/pull/1447 · Nota
• https://github.com/undertow-io/undertow/pull/1457/commits/a4d3b167126a803cc4f7fb740dd9a6ecabf59342 · Nota
• https://osv.dev/vulnerability/GHSA-pfcc-3g6r-8rg8 · Aviso do Fabricante
• https://t.me/cvenotify/44845 · Publicação no Telegram
• https://access.redhat.com/security/cve/CVE-2022-4492 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-4492 · Nota de Segurança
• https://ubuntu.com/security/CVE-2022-4492 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2022-4492 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4492 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4492 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2153260 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230324-0002 · Nota