PT-2020-5137 · Red Hat · Undertow Http Server

Published 2020-01-23 · Updated 2022-05-24 · CVE-2019-14888

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Undertow HTTP server versions prior to 2.0.29

Description A vulnerability in the Undertow HTTP server allows an attacker to carry out a Denial Of Service (DOS) attack by targeting the HTTPS port, making the service unavailable on SSL. This issue is related to an uncontrolled resource consumption.

Recommendations For versions prior to 2.0.29, update to version 2.0.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTPS port to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2020-05733

CVE-2019-14888

GHSA-VJXC-FRW4-JMH5

RHSA-2020:0159

RHSA-2020:0160

RHSA-2020:0161

RHSA-2024:5856

Affected Products

Undertow Http Server

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14888 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0729 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14888 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vjxc-frw4-jmh5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05733 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-14888 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14888 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-14888 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14888 · Security Note
• https://ubuntu.com/security/CVE-2019-14888 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2019-14888 · Note
• https://security.netapp.com/advisory/ntap-20220211-0001 · Note