PT-2021-11416 · Red Hat · Undertow
Published
2021-02-23
·
Updated
2022-02-09
·
CVE-2020-27782
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Undertow versions 2.0.33.SP2, 2.1.5.SP1, 2.2.3.SP1
Description:
A flaw was found in the Undertow AJP connector, allowing malicious requests and abrupt connection closes to be triggered by an attacker using query strings with non-RFC compliant characters, resulting in a denial of service. The highest threat from this issue is to system availability.
Recommendations:
For Undertow version 2.0.33.SP2, update to a fixed version to resolve the issue.
For Undertow version 2.1.5.SP1, update to a fixed version to resolve the issue.
For Undertow version 2.2.3.SP1, update to a fixed version to resolve the issue.
As a temporary workaround, consider restricting the use of query strings with non-RFC compliant characters in the Undertow AJP connector until a patch is available.
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Undertow