Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jaDdxLWdwZmYtaDlocM4AA9on

Undertow Missing Release of Memory after Effective Lifetime vulnerability

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Permalink: https://github.com/advisories/GHSA-ch7q-gpff-h9hp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jaDdxLWdwZmYtaDlocM4AA9on
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 5 months ago
Updated: 17 days ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Identifiers: GHSA-ch7q-gpff-h9hp, CVE-2024-3653
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-3653
• https://access.redhat.com/security/cve/CVE-2024-3653
• https://bugzilla.redhat.com/show_bug.cgi?id=2274437
• https://access.redhat.com/errata/RHSA-2024:4392
• https://access.redhat.com/errata/RHSA-2024:5143
• https://access.redhat.com/errata/RHSA-2024:5144
• https://access.redhat.com/errata/RHSA-2024:5145
• https://access.redhat.com/errata/RHSA-2024:5147
• https://access.redhat.com/errata/RHSA-2024:6437
• https://github.com/undertow-io/undertow/pull/1639
• https://github.com/undertow-io/undertow/pull/1640
• https://github.com/undertow-io/undertow/pull/1641
• https://issues.redhat.com/browse/UNDERTOW-2382
• https://github.com/advisories/GHSA-ch7q-gpff-h9hp

Repository: https://github.com/undertow-io/undertow
Blast Radius: 19.7

Affected Packages