high7.5
CVE-2021-3859
Undertow vulnerable to Denial of Service (DoS) attacks
Impact
Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | < 2.2.15 | 2.2.15 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Jboss Enterprise Application Platform | Versions 7.3, 7.4 |
| Redhat | Single Sign-On | Versions 7.4.10, 7.5.1 |
| Redhat | Undertow | before 2.2.15 |
| Netapp | Cloud Secure Agent | All versions |
| Netapp | Oncommand Insight | All versions |
| Netapp | Oncommand Workflow Automation | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/security/cve/CVE-2021-3859
- https://bugzilla.redhat.com/show_bug.cgi?id=2010378
- https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
- https://github.com/undertow-io/undertow/pull/1296
- https://issues.redhat.com/browse/UNDERTOW-1979
- https://security.netapp.com/advisory/ntap-20221201-0004/
- https://github.com/advisories/GHSA-339q-62wm-c39w
- https://nvd.nist.gov/vuln/detail/CVE-2021-3859
- https://github.com/undertow-io/undertow/commit/db0f5be43f8e2a4b88fbedd2eb6d5a95a29ceaa8
- https://access.redhat.com/security/cve/cve-2021-3859