Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zMzlxLTYyd20tYzM5d84AAtaB

Undertow vulnerable to Denial of Service (DoS) attacks

Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.

Permalink: https://github.com/advisories/GHSA-339q-62wm-c39w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zMzlxLTYyd20tYzM5d84AAtaB
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-339q-62wm-c39w, CVE-2021-3859
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-3859
• https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8
• https://access.redhat.com/security/cve/cve-2021-3859
• https://bugzilla.redhat.com/show_bug.cgi?id=2010378
• https://github.com/undertow-io/undertow/pull/1296
• https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
• https://issues.redhat.com/browse/UNDERTOW-1979
• https://security.netapp.com/advisory/ntap-20221201-0004/
• https://github.com/advisories/GHSA-339q-62wm-c39w

Repository: https://github.com/undertow-io/undertow
Blast Radius: 27.9

Affected Packages