CVE-2024-4109

undertow: information leakage via HTTP/2 request header reuse

View on CVE.org
Published Dec 12, 2024 CVSS 3.1 · 0.0 Low EPSS n/a KEV · Not listed
Description
Red Hat Product Security has determined that this CVE is not a security vulnerability.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-22c5-cpvr-cfvq Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse
History
Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Moderate

 cvssV3_1

{'score': 0.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N'}

threat_severity

None
Type Values Removed Values Added
Title Undertow: information leakage via http/2 request header reuse undertow: information leakage via HTTP/2 request header reuse
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw was found in Undertow. An HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2 connection. This issue can potentially lead to information leakage between requests. Red Hat Product Security has determined that this CVE is not a security vulnerability.
Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_spring_boot:3
cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:integration:1
cpe:/a:redhat:jboss_data_grid:7
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/a:redhat:rhboac_hawtio:4
Vendors & Products Redhat build Keycloak
Redhat camel Spring Boot
Redhat integration
Redhat jboss Data Grid
Redhat jboss Enterprise Bpms Platform
Redhat jboss Fuse
Redhat jbosseapxp
Redhat red Hat Single Sign On
Redhat rhboac Hawtio
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8.0
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7.4
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Description A flaw was found in Undertow. An HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2 connection. This issue can potentially lead to information leakage between requests.
Title Undertow: information leakage via http/2 request header reuse
First Time appeared Redhat
Redhat build Keycloak
Redhat camel Spring Boot
Redhat integration
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Enterprise Bpms Platform
Redhat jboss Fuse
Redhat jbosseapxp
Redhat red Hat Single Sign On
Redhat rhboac Hawtio
Weaknesses CWE-200
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_spring_boot:3
cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:integration:1
cpe:/a:redhat:jboss_data_grid:7
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/a:redhat:rhboac_hawtio:4
Vendors & Products Redhat
Redhat build Keycloak
Redhat camel Spring Boot
Redhat integration
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Enterprise Bpms Platform
Redhat jboss Fuse
Redhat jbosseapxp
Redhat red Hat Single Sign On
Redhat rhboac Hawtio
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}
Earlier changes (7)
Weaknesses

Sources

Status
REJECTED
Assigner
redhat
Published
Updated
Jan 16, 2025, 9:48 PM
Reserved
Apr 24, 2024, 12:55 AM

View source JSON

Updated

JSON

Status
Rejected
Published
Dec 12, 2024, 9:15 AM
Modified
Jan 16, 2025, 10:15 PM

View source JSON

Severity
Public date
Dec 10, 2024, 4:35 PM

View source Bugzilla JSON

No data.