Undertow client not checking server identity presented by server certificate in https connections
The undertow client is not checking the server identity presented by the server certificate in https connections. This should be performed by default in https and in http/2.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-4492US | high7.5 | — | ||
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by defa… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2022-4492WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2153260WEB
- https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/security/impl/ClientCertAuthenticationMechanism.javaWEB
- https://github.com/undertow-io/undertow/pull/1447WEB
- https://github.com/undertow-io/undertow/pull/1447/commits/e5071e52b72529a14d3ec436ae7102cea5d918c4WEB
- https://github.com/undertow-io/undertow/pull/1457WEB
- https://github.com/undertow-io/undertow/pull/1457/commits/a4d3b167126a803cc4f7fb740dd9a6ecabf59342WEB
- https://issues.redhat.com/browse/MTA-93WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan