CVE-2019-19343
High
Description
A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1 are believed to be vulnerable.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Redhat Jboss-remoting
PublishedMar 23, 2021
First seenMar 23, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- redhat jboss-remoting5.0.14 or later
- redhat jboss_enterprise_application_platform7.2.4 or later
- redhat undertow2.0.25 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss-remoting | v < 5.0.14, 5.0.14 | 5.0.14 |
| redhat jboss_enterprise_application_platform | v < 7.2.4 | 7.2.4 |
| redhat undertow | v < 2.0.25, 2.0.25 | 2.0.25 |
| netapp active_iq_unified_manager | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.