Most recent entries from all

fkie_cve-2024-4109

Rejected reason: Red Hat Product Security has determined that this CVE is not a security vulnerability.

Withdrawn: GHSA-22c5-cpvr-cfvq — Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse

Withdrawn by the publisher.

Affected: Maven: io.undertow:undertow-core

# Withdrawn Advisory This advisory has been withdrawn because it was determined to not be a valid vulnerability. This link is maintained to preserve external references. For more information, see https://nvd.nist.gov/vuln/detail/CVE-2024-4109.

# Original Description A flaw was found in Undertow. An HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2 connection. This issue can potentially lead to information leakage between requests.

gsd-2024-4109

OESA-2024-2579 — undertow security update

Affected: openEuler:22.03-LTS-SP3: undertow, openEuler:20.03-LTS-SP4: undertow, openEuler:22.03-LTS-SP1: undertow, openEuler:24.03-LTS: undertow, openEuler:22.03-LTS-SP4: undertow

Java web server using non-blocking IO Security Fix(es): Description: Product Security received a report that Undertow might incorrectly re-use an HTTP request header value from a previous stream for a request associated with a subsequent stream on the same HTTP/2 connection. The issue is linked to the readHpackString method and its interaction with the stringBuilder field. While such behavior typically results in an error followed by the termination of the HTTP/2 connection, it presents a potential vector for information leakage between requests. The original reporter referenced a similar issue in Apache Tomcat (CVE-2020-17527). In the patch for that vulnerability (https://github.com/apache/tomcat/commit/8d2fe6894d6e258a6d615d7f786acca80e6020cb) a StringBuilder field was improperly reused across multiple requests, leading to this issue. In the io.undertow.protocols.http2.HpackDecoder class of Undertow, within the readHpackString method, there is a code pattern identical to the one mentioned: ``` for (int i = 0; i < length; ++i) { stringBuilder.append((char) buffer.get()); } String ret = stringBuilder.toString(); stringBuilder.setLength(0); if (ret.isEmpty()) { //return the interned empty string, rather than allocating a new one each time return ""; } ``` Steps to reproduce: No reproducers or PoC were provided, this issue was identified through static testing. Affected versions: 2.2.x, 2.3.x, and 3.x(CVE-2024-4109)

RHSA-2024:10927 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.20 Security update

undertow: information leakage via HTTP/2 request header reuse

Withdrawn: UBUNTU-CVE-2024-4109

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:Pro:20.04:LTS: undertow, Ubuntu:22.04:LTS: undertow, Ubuntu:24.10: undertow, Ubuntu:24.04:LTS: undertow

Rejected reason: Red Hat Product Security has determined that this CVE is not a security vulnerability.

WID-SEC-W-2024-3654 — Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat JBoss Enterprise Application Platform ausnutzen, um Informationen offenzulegen.