Undertow vulnerable to Denial of Service (DoS) attacks
Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-3859US | high7.5 | — | ||
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2021-3859WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2010378WEB
- https://github.com/undertow-io/undertowPACKAGE
- https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8WEB
- https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2WEB
- https://github.com/undertow-io/undertow/pull/1296WEB
- https://issues.redhat.com/browse/UNDERTOW-1979WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-3859ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan