title: Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol
description: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.
At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.
problem types: Uncontrolled Resource Consumption
affected:
{
product: undertow
vendor: n/a
versions:
version: 2.3.10.SP3, status: unaffected
version: 2.2.30.SP1, status: unaffected
}
{
product: upstream
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: EAP 7.4.16
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: undertow
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-activemq-artemis
defaultStatus: affected
versions:
version: 0:2.16.0-18.redhat_00052.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-apache-cxf
defaultStatus: affected
versions:
version: 0:3.4.10-2.redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-eclipse-jgit
defaultStatus: affected
versions:
version: 0:5.13.3.202401111512-1.r_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-elytron-web
defaultStatus: affected
versions:
version: 0:1.9.4-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hal-console
defaultStatus: affected
versions:
version: 0:3.3.21-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hibernate
defaultStatus: affected
versions:
version: 0:5.3.36-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-infinispan
defaultStatus: affected
versions:
version: 0:11.0.18-2.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-insights-java-client
defaultStatus: affected
versions:
version: 0:1.1.2-1.redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jberet
defaultStatus: affected
versions:
version: 0:1.3.9-3.SP3_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-annotations-api_1.3_spec
defaultStatus: affected
versions:
version: 0:2.0.1-3.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-cert-helper
defaultStatus: affected
versions:
version: 0:1.1.2-1.redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-remoting
defaultStatus: affected
versions:
version: 0:5.0.27-4.SP2_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-server-migration
defaultStatus: affected
versions:
version: 0:1.10.0-35.Final_redhat_00034.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-xnio-base
defaultStatus: affected
versions:
version: 0:3.8.12-1.SP2_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jgroups-kubernetes
defaultStatus: affected
versions:
version: 0:1.0.17-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-lucene-solr
defaultStatus: affected
versions:
version: 0:5.5.5-6.redhat_2.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.30-1.SP1_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.16-4.GA_redhat_00002.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.22-1.Final_redhat_00001.1.el8eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-activemq-artemis
defaultStatus: affected
versions:
version: 0:2.16.0-18.redhat_00052.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-apache-cxf
defaultStatus: affected
versions:
version: 0:3.4.10-2.redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-eclipse-jgit
defaultStatus: affected
versions:
version: 0:5.13.3.202401111512-1.r_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-elytron-web
defaultStatus: affected
versions:
version: 0:1.9.4-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hal-console
defaultStatus: affected
versions:
version: 0:3.3.21-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hibernate
defaultStatus: affected
versions:
version: 0:5.3.36-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-infinispan
defaultStatus: affected
versions:
version: 0:11.0.18-2.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-insights-java-client
defaultStatus: affected
versions:
version: 0:1.1.2-1.redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jberet
defaultStatus: affected
versions:
version: 0:1.3.9-3.SP3_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-annotations-api_1.3_spec
defaultStatus: affected
versions:
version: 0:2.0.1-3.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-cert-helper
defaultStatus: affected
versions:
version: 0:1.1.2-1.redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-remoting
defaultStatus: affected
versions:
version: 0:5.0.27-4.SP2_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-server-migration
defaultStatus: affected
versions:
version: 0:1.10.0-35.Final_redhat_00034.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-xnio-base
defaultStatus: affected
versions:
version: 0:3.8.12-1.SP2_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jgroups-kubernetes
defaultStatus: affected
versions:
version: 0:1.0.17-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-lucene-solr
defaultStatus: affected
versions:
version: 0:5.5.5-6.redhat_2.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.30-1.SP1_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.16-4.GA_redhat_00002.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.22-1.Final_redhat_00001.1.el9eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-activemq-artemis
defaultStatus: affected
versions:
version: 0:2.16.0-18.redhat_00052.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-apache-cxf
defaultStatus: affected
versions:
version: 0:3.4.10-2.redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-eclipse-jgit
defaultStatus: affected
versions:
version: 0:5.13.3.202401111512-1.r_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-elytron-web
defaultStatus: affected
versions:
version: 0:1.9.4-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hal-console
defaultStatus: affected
versions:
version: 0:3.3.21-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-hibernate
defaultStatus: affected
versions:
version: 0:5.3.36-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-infinispan
defaultStatus: affected
versions:
version: 0:11.0.18-2.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-insights-java-client
defaultStatus: affected
versions:
version: 0:1.1.2-1.redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jberet
defaultStatus: affected
versions:
version: 0:1.3.9-3.SP3_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-annotations-api_1.3_spec
defaultStatus: affected
versions:
version: 0:2.0.1-3.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-cert-helper
defaultStatus: affected
versions:
version: 0:1.1.2-1.redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-remoting
defaultStatus: affected
versions:
version: 0:5.0.27-4.SP2_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-server-migration
defaultStatus: affected
versions:
version: 0:1.10.0-35.Final_redhat_00034.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jboss-xnio-base
defaultStatus: affected
versions:
version: 0:3.8.12-1.SP2_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-jgroups-kubernetes
defaultStatus: affected
versions:
version: 0:1.0.17-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-lucene-solr
defaultStatus: affected
versions:
version: 0:5.5.5-6.redhat_2.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-undertow
defaultStatus: affected
versions:
version: 0:2.2.30-1.SP1_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly
defaultStatus: affected
versions:
version: 0:7.4.16-4.GA_redhat_00002.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: eap7-wildfly-elytron
defaultStatus: affected
versions:
version: 0:1.15.22-1.Final_redhat_00001.1.el7eap, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
}
{
vendor: Red Hat
product: OpenShift Serverless
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:serverless:1
}
{
vendor: Red Hat
product: Red Hat build of Apache Camel 4.0 for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_spring_boot:4
}
{
vendor: Red Hat
product: Red Hat build of Apache Camel for Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_quarkus:3
}
{
vendor: Red Hat
product: Red Hat build of Apache Camel for Spring Boot
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_spring_boot:3
}
{
vendor: Red Hat
product: Red Hat Build of Keycloak
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:build_keycloak:22
}
{
vendor: Red Hat
product: Red Hat build of OptaPlanner 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:optaplanner:::el6
}
{
vendor: Red Hat
product: Red Hat build of Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: io.quarkus/quarkus-undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:quarkus:3
}
{
vendor: Red Hat
product: Red Hat Data Grid 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_data_grid:8
}
{
vendor: Red Hat
product: Red Hat Integration Camel K
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:integration:1
}
{
vendor: Red Hat
product: Red Hat Integration Camel Quarkus
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:camel_quarkus:2
}
{
vendor: Red Hat
product: Red Hat Integration Service Registry
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:service_registry:2
}
{
vendor: Red Hat
product: Red Hat JBoss A-MQ Streams
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:amq_streams:1
}
{
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_data_grid:7
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unaffected
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse:7
}
{
vendor: Red Hat
product: Red Hat JBoss Fuse Service Works 6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_fuse_service_works:6
}
{
vendor: Red Hat
product: Red Hat Process Automation 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: undertow
defaultStatus: affected
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: No mitigation is currently available for this vulnerability. However, there might be some protections, such as request limits by a load balancer in front of JBoss EAP/Wildfly or even Undertow, that could minimize the impact.