PT-2022-18544 · Undertow · Undertow

Sandipan Roy · Published 2022-09-01 · Updated 2022-11-07 · CVE-2022-2764

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description A flaw was found in Undertow, allowing denial of service as the Undertow server waits for the LAST CHUNK forever for EJB invocations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-2764

RHSA-2022:8790

RHSA-2022:8791

RHSA-2022:8792

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Affected Products

Undertow

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-2764 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2764 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2764 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-2764 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2764 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2764 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2764 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2117506 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20221014-0006 · Note
• https://t.me/cvenotify/35607 · Telegram Post
• https://t.me/cibsecurity/49212 · Telegram Post