GHSA-rhcw-wjcm-9h6g

ghsaUSosv

Denial of service in Undertow

view advisory published 2022-02-09Licence: CC-BY-4.0

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-27782US	high7.5	1.38% (72nd)	—	2021-02-23
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant charact…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1901304WEB
https://github.com/undertow-io/undertow/pull/997/commits/98a9ab7f2d7fe7a7254eaf17d47816c452169c90WEB
https://issues.redhat.com/browse/UNDERTOW-1813WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-27782ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan