PT-2023-14569 · Undertow · Undertow

Sandipan Roy · Published 2023-02-23 · Updated 2025-03-12 · CVE-2022-4492

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description The undertow client does not check the server identity presented by the server certificate in https connections, which is a compulsory step that should be performed by default in https and http/2. This issue affects the TLS client protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-4492

GHSA-PFCC-3G6R-8RG8

RHSA-2023:1512

RHSA-2023:1513

RHSA-2023:1514

RHSA-2023:2705

RHSA-2023:2706

RHSA-2023:2707

RHSA-2025:9582

RHSA-2025:9583

Affected Products

Undertow

References · 21

• https://osv.dev/vulnerability/GHSA-pfcc-3g6r-8rg8 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2022-4492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4492 · Security Note
• https://ubuntu.com/security/CVE-2022-4492 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4492 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4492 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4492 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2153260 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-4492 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4492 · Vendor Advisory
• https://github.com/undertow-io/undertow/pull/1447/commits/e5071e52b72529a14d3ec436ae7102cea5d918c4 · Note
• https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/security/impl/ClientCertAuthenticationMechanism.java · Note
• https://github.com/undertow-io/undertow/pull/1457 · Note
• https://github.com/undertow-io/undertow/pull/1447 · Note
• https://github.com/undertow-io/undertow/pull/1457/commits/a4d3b167126a803cc4f7fb740dd9a6ecabf59342 · Note