PT-2019-5311 · Red Hat · Undertow

Marian Rehak · Published 2019-10-02 · Updated 2025-03-07 · CVE-2019-10212

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.0.20

Description A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files. The vulnerability is related to the disclosure of information through log files and can be exploited by a remote attacker.

Recommendations For versions prior to 2.0.20, consider disabling the DEBUG log for io.undertow.request.security to prevent the disclosure of user credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2020-02258

CVE-2019-10212

GHSA-8VH8-VC28-M2HF

OESA-2025-1257

RHSA-2019:2935

RHSA-2019:2936

RHSA-2019:2937

Affected Products

Undertow

References · 22

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1257 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12196 · Security Note
• https://access.redhat.com/errata/RHSA-2020:0727 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10212 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10212 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10212 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-10212 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10184 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10212 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10212 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02258 · Security Note
• https://osv.dev/vulnerability/GHSA-8vh8-vc28-m2hf · Vendor Advisory