PT-2022-10741 · Undertow · Undertow

Flavia Rainone · Published 2022-07-15 · Updated 2022-12-13 · CVE-2021-3859

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.2.15 Final

Description A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Recommendations For versions prior to 2.2.15 Final, update to version 2.2.15 Final or later to resolve the issue. As a temporary workaround, consider restricting access to HTTP2 calls to minimize the risk of exploitation.

Fix

DoS

Exposure of Resource to Wrong Sphere

Resource Exhaustion

Weakness Enumeration

CWE-668

CWE-400

CWE-214

Related Identifiers

CVE-2021-3859

GHSA-339Q-62WM-C39W

RHSA-2022:0400

RHSA-2022:0401

RHSA-2022:0405

RHSA-2022:0447

RHSA-2022:0448

RHSA-2024:10207

RHSA-2025:4226

Affected Products

Undertow

References · 19

• https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3859 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3859 · Vendor Advisory
• https://issues.redhat.com/browse/UNDERTOW-1979 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3859 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3859 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2010378 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3859 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3859 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-339q-62wm-c39w · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2021-3859 · Vendor Advisory
• https://github.com/undertow-io/undertow/pull/1296 · Note
• https://github.com/undertow-io/undertow · Note
• https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8 · Note