high7.5
CVE-2020-27782
Denial of service in Undertow
Impact
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | >= 2.1.0, < 2.1.5 | 2.1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Jboss Fuse | Versions 6.0.0, 7.0.0 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Undertow | Versions 2.0.33, 2.1.5, 2.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1901304
- https://github.com/advisories/GHSA-rhcw-wjcm-9h6g
- https://nvd.nist.gov/vuln/detail/CVE-2020-27782
- https://github.com/undertow-io/undertow/pull/997/commits/98a9ab7f2d7fe7a7254eaf17d47816c452169c90
- https://issues.redhat.com/browse/UNDERTOW-1813