CVE-2022-4492
High
Description
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Redhat Undertow
PublishedFeb 23, 2023
First seenFeb 23, 2023
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- io.undertow:undertow-core2.3.5.Final, 2.2.24.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat undertow | 2.7.0 | — |
| redhat build_of_quarkus | No range specified | — |
| redhat integration_camel_for_spring_boot | No range specified | — |
| redhat integration_camel_k | No range specified | — |
| redhat integration_service_registry | No range specified | — |
| redhat jboss_enterprise_application_platform | 7.0.0 | — |
| redhat jboss_fuse | 7.0.0 | — |
| redhat migration_toolkit_for_applications | 6.0 | — |
| redhat migration_toolkit_for_runtimes | No range specified | — |
| redhat single_sign-on | 7.0 | — |
| io.undertow:undertow-coreMaven | 2.3.0 ≤ v < 2.3.5.Final, v < 2.2.24.Final | 2.3.5.Final, 2.2.24.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.