critical9.8
CVE-2022-4492
Undertow client not checking server identity presented by server certificate in https connections
Impact
The undertow client is not checking the server identity presented by the server certificate in https connections. This should be performed by default in https and in http/2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | >= 2.3.0, < 2.3.5.Final | 2.3.5.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Build Of Quarkus | All versions |
| Redhat | Integration Camel For Spring Boot | All versions |
| Redhat | Integration Camel K | All versions |
| Redhat | Integration Service Registry | All versions |
| Redhat | Jboss Enterprise Application Platform | Version 7.0.0 |
| Redhat | Jboss Fuse | Version 7.0.0 |
| Redhat | Migration Toolkit For Applications | Version 6.0 |
| Redhat | Migration Toolkit For Runtimes | All versions |
| Redhat | Single Sign-On | Version 7.0 |
| Redhat | Undertow | Version 2.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/security/cve/CVE-2022-4492
- https://bugzilla.redhat.com/show_bug.cgi?id=2153260
- https://security.netapp.com/advisory/ntap-20230324-0002/
- https://github.com/advisories/GHSA-pfcc-3g6r-8rg8
- https://nvd.nist.gov/vuln/detail/CVE-2022-4492
- https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/security/impl/ClientCertAuthenticationMechanism.java
- https://issues.redhat.com/browse/MTA-93
- https://github.com/undertow-io/undertow/pull/1447
- https://github.com/undertow-io/undertow/pull/1447/commits/e5071e52b72529a14d3ec436ae7102cea5d918c4
- https://github.com/undertow-io/undertow/pull/1457
- https://github.com/undertow-io/undertow/pull/1457/commits/a4d3b167126a803cc4f7fb740dd9a6ecabf59342
- https://issues.redhat.com/browse/UNDERTOW-2212
- https://security.netapp.com/advisory/ntap-20230324-0002