CVE-2024-7885

Undertow: improper state management in proxy protocol parsing causes information leakage

View on CVE.org

Published Aug 21, 2024 CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed

Description

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

unaffected

Version	Status	Constraints
`0`	affected	< 2.2.36.Final
`2.3.0.Alpha1`	affected	< 2.3.17.Final

Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4 unaffected —

Red Hat Red Hat build of Apache Camel 3.20.7 for Spring Boot unaffected —

Red Hat Red Hat build of Apache Camel 4.4.2 for Spring Boot unaffected —

Red Hat

Red Hat JBoss Enterprise Application Platform

affected

Version	Status	Constraints
`2.2.33.SP2-redhat-00001`	unaffected	< *

Red Hat Red Hat JBoss Enterprise Application Platform 7 unaffected —

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:1.11.0-1.redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.4.11-1.Final_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:1.7.2-19.Final_redhat_00020.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.0.41-5.SP6_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:7.3.15-5.GA_redhat_00003.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-4.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-4.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-6.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-4.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-6.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-3.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:1.7.2-20.Final_redhat_00021.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:4.1.63-6.Final_redhat_00004.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.0.41-6.SP7_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:7.3.16-3.GA_redhat_00003.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

affected

Version	Status	Constraints
`0:2.2.33-2.SP2_redhat_00001.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

affected

Version	Status	Constraints
`0:7.4.18-1.GA_redhat_00003.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

affected

Version	Status	Constraints
`0:2.2.33-2.SP2_redhat_00001.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

affected

Version	Status	Constraints
`0:7.4.18-1.GA_redhat_00003.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

affected

Version	Status	Constraints
`0:2.2.33-2.SP2_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

affected

Version	Status	Constraints
`0:7.4.18-1.GA_redhat_00003.1.el7eap`	unaffected	< *

Red Hat Red Hat JBoss Enterprise Application Platform 8 unaffected —

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:1.11.9-2.redhat_00001.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:800.3.1-2.GA_redhat_00002.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:2.3.14-2.SP2_redhat_00001.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:8.0.3-13.GA_redhat_00007.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:1.11.9-2.redhat_00001.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:800.3.1-2.GA_redhat_00002.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:2.3.14-2.SP2_redhat_00001.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:8.0.3-13.GA_redhat_00007.1.el9eap`	unaffected	< *

Red Hat Red Hat build of Apache Camel for Spring Boot 3 affected —

Red Hat Red Hat Build of Keycloak affected —

Red Hat Red Hat build of Quarkus unaffected —

Red Hat Red Hat Data Grid 8 affected —

Red Hat Red Hat Fuse 7 affected —

Red Hat Red Hat Integration Camel K 1 affected —

Red Hat Red Hat JBoss Data Grid 7 unknown —

Red Hat Red Hat JBoss Enterprise Application Platform 7 unaffected —

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack unaffected —

Red Hat Red Hat Process Automation 7 unknown —

Red Hat Red Hat Single Sign-On 7 affected —

Configuration 1 [-]

OR	cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:::::::*
	cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:::::::*
	cpe:2.3:a:redhat:build_of_keycloak:-:::::::*
	cpe:2.3:a:redhat:data_grid:8.0.0:::::::*
	cpe:2.3:a:redhat:integration_camel_k:-:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:::::::*
	cpe:2.3:a:redhat:jboss_fuse:7.0.0:::::::*
	cpe:2.3:a:redhat:process_automation:7.0:::::::*
	cpe:2.3:a:redhat:single_sign-on:7.0:::::::*

Package	CPE	Advisory	Released Date
HawtIO 4.0.0 for Red Hat build of Apache Camel 4
undertow	cpe:/a:redhat:rhboac_hawtio:4.0.0	RHSA-2024:11023	2024-12-12T00:00:00Z
Red Hat build of Apache Camel 3.20.7 for Spring Boot
undertow	cpe:/a:redhat:apache_camel_spring_boot:3.20.7	RHSA-2024:6883	2024-09-19T00:00:00Z
Red Hat build of Apache Camel 4.4.2 for Spring Boot
undertow	cpe:/a:redhat:apache_camel_spring_boot:4.4.2	RHSA-2024:6508	2024-09-09T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7
	cpe:/a:redhat:jboss_enterprise_application_platform:7.4	RHSA-2024:7735	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8	RHSA-2024:7736	2024-10-07T00:00:00Z
eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8	RHSA-2024:7736	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9	RHSA-2024:7736	2024-10-07T00:00:00Z
eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9	RHSA-2024:7736	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el7eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7	RHSA-2024:7736	2024-10-07T00:00:00Z
eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el7eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7	RHSA-2024:7736	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 8
undertow-core	cpe:/a:redhat:jboss_enterprise_application_platform:8.0	RHSA-2024:7442	2024-10-01T00:00:00Z
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-9623-mqmm-5rcf	Undertow vulnerable to Race Condition

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.6% (2.644% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2024:11023
https://access.redhat.com/errata/RHSA-2024:6508
https://access.redhat.com/errata/RHSA-2024:6883
https://access.redhat.com/errata/RHSA-2024:7441
https://access.redhat.com/errata/RHSA-2024:7442
https://access.redhat.com/errata/RHSA-2024:7735
https://access.redhat.com/errata/RHSA-2024:7736
https://access.redhat.com/errata/RHSA-2024:8080
https://access.redhat.com/errata/RHSA-2025:16667
https://access.redhat.com/errata/RHSA-2026:0743
https://access.redhat.com/security/cve/CVE-2024-7885
https://bugzilla.redhat.com/show_bug.cgi?id=2305290
https://nvd.nist.gov/vuln/detail/CVE-2024-7885
https://security.netapp.com/advisory/ntap-20241011-0004/
https://www.cve.org/CVERecord?id=CVE-2024-7885

History

Nov 4, 2026 9:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat camel K Redhat jboss Bpms
CPEs	cpe:/a:redhat:apache_camel_hawtio:4 cpe:/a:redhat:integration:1 cpe:/a:redhat:jboss_enterprise_bpms_platform:7 cpe:/a:redhat:rhboac_hawtio:4.0	cpe:/a:redhat:apache_camel_hawtio:4.0 cpe:/a:redhat:camel_k:1 cpe:/a:redhat:jboss_bpms:7
Vendors & Products	Redhat integration Redhat jboss Enterprise Bpms Platform	Redhat camel K Redhat jboss Bpms

Oct 8, 2026 11:15 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:rhboac_hawtio:4.0

Aug 7, 2026 10:15 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:jboss_enterprise_application_platform:7

Jan 19, 2026 4:00 AM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:0743

Oct 23, 2025 10:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2024:8080

Sep 25, 2025 7:30 AM First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
First Time appeared		Redhat jboss Enterprise Application Platform Eus
CPEs		cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
Vendors & Products		Redhat jboss Enterprise Application Platform Eus
References		https://access.redhat.com/errata/RHSA-2025:16667

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.28035}`	epss `{'score': 0.24383}`

Jun 18, 2025 6:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat apache Camel Hawtio
CPEs		cpe:/a:redhat:apache_camel_hawtio:4
Vendors & Products		Redhat apache Camel Hawtio

Dec 12, 2024 10:00 PM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:rhboac_hawtio:4~~	cpe:/a:redhat:rhboac_hawtio:4.0.0
References		https://access.redhat.com/errata/RHSA-2024:11023

Nov 22, 2024 12:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20241011-0004/

Oct 7, 2024 9:15 PM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:jboss_enterprise_application_platform:7~~	cpe:/a:redhat:jboss_enterprise_application_platform:7.4 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
References		https://access.redhat.com/errata/RHSA-2024:7735 https://access.redhat.com/errata/RHSA-2024:7736

Oct 1, 2024 11:15 AM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:jboss_enterprise_application_platform:8~~	cpe:/a:redhat:jboss_enterprise_application_platform:8.0 cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
References		https://access.redhat.com/errata/RHSA-2024:7441 https://access.redhat.com/errata/RHSA-2024:7442

Sep 19, 2024 8:00 PM Affected versions updated. Added references View changes

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:apache_camel_spring_boot:3.20.7
References		https://access.redhat.com/errata/RHSA-2024:6883

Sep 18, 2024 7:45 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:build_keycloak:22~~	cpe:/a:redhat:build_keycloak:

Sep 9, 2024 10:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
First Time appeared		Redhat apache Camel Spring Boot
CPEs	~~cpe:/a:redhat:camel_spring_boot:4~~	cpe:/a:redhat:apache_camel_spring_boot:4.4.2 cpe:/a:redhat:camel_spring_boot:3
Vendors & Products		Redhat apache Camel Spring Boot
References		https://access.redhat.com/errata/RHSA-2024:6508

Aug 23, 2024 5:30 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat build Of Apache Camel - Hawtio Redhat build Of Apache Camel For Spring Boot Redhat build Of Keycloak Redhat data Grid Redhat integration Camel K Redhat process Automation Redhat single Sign-on
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:::::::* cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:::::::* cpe:2.3:a:redhat:build_of_keycloak:-:::::::* cpe:2.3:a:redhat:data_grid:8.0.0:::::::* cpe:2.3:a:redhat:integration_camel_k:-:::::::* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:::::::* cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:::::::* cpe:2.3:a:redhat:jboss_fuse:7.0.0:::::::* cpe:2.3:a:redhat:process_automation:7.0:::::::* cpe:2.3:a:redhat:single_sign-on:7.0:::::::*
Vendors & Products		Redhat build Of Apache Camel - Hawtio Redhat build Of Apache Camel For Spring Boot Redhat build Of Keycloak Redhat data Grid Redhat integration Camel K Redhat process Automation Redhat single Sign-on

Aug 21, 2024 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 21, 2024 2:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description	No description is available for this CVE.	A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
Title	undertow: Improper State Management in Proxy Protocol parsing causes information leakage	Undertow: improper state management in proxy protocol parsing causes information leakage
First Time appeared		Redhat Redhat build Keycloak Redhat camel Spring Boot Redhat integration Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Enterprise Bpms Platform Redhat jboss Fuse Redhat jbosseapxp Redhat quarkus Redhat red Hat Single Sign On Redhat rhboac Hawtio
CPEs		cpe:/a:redhat:build_keycloak:22 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:integration:1 cpe:/a:redhat:jboss_data_grid:7 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_bpms_platform:7 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:jbosseapxp cpe:/a:redhat:quarkus:3 cpe:/a:redhat:red_hat_single_sign_on:7 cpe:/a:redhat:rhboac_hawtio:4
Vendors & Products		Redhat Redhat build Keycloak Redhat camel Spring Boot Redhat integration Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Enterprise Bpms Platform Redhat jboss Fuse Redhat jbosseapxp Redhat quarkus Redhat red Hat Single Sign On Redhat rhboac Hawtio
References		https://access.redhat.com/security/cve/CVE-2024-7885 https://bugzilla.redhat.com/show_bug.cgi?id=2305290

Aug 16, 2024 11:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		No description is available for this CVE.
Title		undertow: Improper State Management in Proxy Protocol parsing causes information leakage
Weaknesses		CWE-362
References		https://nvd.nist.gov/vuln/detail/CVE-2024-7885 https://www.cve.org/CVERecord?id=CVE-2024-7885
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Earlier changes (14)

Subscriptions

Redhat Apache Camel Hawtio Apache Camel Spring Boot Build Keycloak Build Of Apache Camel - Hawtio Build Of Apache Camel For Spring Boot Build Of Keycloak Camel K Camel Spring Boot Data Grid Integration Camel K Jboss Bpms Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus Jboss Fuse Jbosseapxp Process Automation Quarkus Red Hat Single Sign On Rhboac Hawtio Single Sign-on

Weaknesses

Sources

CVE record Updated: Nov 4, 2026, 9:05 PM

Status: PUBLISHED
Assigner: redhat
Published: Aug 21, 2024, 2:13 PM
Updated: Nov 4, 2026, 9:05 PM
Reserved: Aug 16, 2024, 3:35 PM

View source JSON

Vulnrichment Updated: Oct 11, 2024, 10:03 PM

Updated: Oct 11, 2024, 10:03 PM

NVD Updated: Nov 4, 2026, 9:17 PM

Status: Modified
Published: Aug 21, 2024, 2:15 PM
Modified: Nov 4, 2026, 9:17 PM

View source JSON

Red Hat Updated: Aug 7, 2024, 12:00 AM

Severity: Important
Public date: Aug 7, 2024, 12:00 AM

View source Bugzilla JSON

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-7885", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-08-16T15:35:47.357Z", "datePublished": "2024-08-21T14:13:36.579Z", "dateUpdated": "2026-11-04T21:05:53.405Z"}, "containers": {"cna": {"title": "Undertow: improper state management in proxy protocol parsing causes information leakage", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.2.36.Final", "versionType": "custom"}, {"status": "affected", "version": "2.3.0.Alpha1", "lessThan": "2.3.17.Final", "versionType": "custom"}], "packageName": "undertow", "collectionURL": "https://github.com/undertow-io/undertow", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4.0"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:3.20.7"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.4.2"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "io.undertow/undertow-core", "defaultStatus": "affected", "versions": [{"version": "2.2.33.SP2-redhat-00001", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-apache-commons-beanutils", "defaultStatus": "affected", "versions": [{"version": "0:1.11.0-1.redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-hornetq", "defaultStatus": "affected", "versions": [{"version": "0:2.4.11-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jboss-server-migration", "defaultStatus": "affected", "versions": [{"version": "0:1.7.2-19.Final_redhat_00020.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.0.41-5.SP6_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.3.15-5.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-annotations", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-core", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-databind", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-jaxrs-providers", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-modules-base", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-modules-java8", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-3.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jboss-server-migration", "defaultStatus": "affected", "versions": [{"version": "0:1.7.2-20.Final_redhat_00021.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-netty", "defaultStatus": "affected", "versions": [{"version": "0:4.1.63-6.Final_redhat_00004.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.0.41-6.SP7_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.3.16-3.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.2.33-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.4.18-1.GA_redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.2.33-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.4.18-1.GA_redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.2.33-2.SP2_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.4.18-1.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow-core", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-amazon-ion-java", "defaultStatus": "affected", "versions": [{"version": "0:1.11.9-2.redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-eap-product-conf-parent", "defaultStatus": "affected", "versions": [{"version": "0:800.3.1-2.GA_redhat_00002.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.3.14-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:8.0.3-13.GA_redhat_00007.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-amazon-ion-java", "defaultStatus": "affected", "versions": [{"version": "0:1.11.9-2.redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-eap-product-conf-parent", "defaultStatus": "affected", "versions": [{"version": "0:800.3.1-2.GA_redhat_00002.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.3.14-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:8.0.3-13.GA_redhat_00007.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel for Spring Boot 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_spring_boot:3"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}, {"vendor": "Red Hat", "product": "Red Hat build of Quarkus", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quarkus-undertow", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat Data Grid 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"]}, {"vendor": "Red Hat", "product": "Red Hat Fuse 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_fuse:7"]}, {"vendor": "Red Hat", "product": "Red Hat Integration Camel K 1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_k:1"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Data Grid 7", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:jboss_data_grid:7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow-core", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow-core", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat Process Automation 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:jboss_bpms:7"]}, {"vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:11023", "name": "RHSA-2024:11023", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6508", "name": "RHSA-2024:6508", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6883", "name": "RHSA-2024:6883", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7441", "name": "RHSA-2024:7441", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7442", "name": "RHSA-2024:7442", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7735", "name": "RHSA-2024:7735", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7736", "name": "RHSA-2024:7736", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:8080", "name": "RHSA-2024:8080", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:16667", "name": "RHSA-2025:16667", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0743", "name": "RHSA-2026:0743", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-7885", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290", "name": "RHBZ#2305290", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-08-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "Concurrent Execution using Shared Resource with Improper Synchronization", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization", "timeline": [{"lang": "en", "time": "2024-08-16T09:00:41.686Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-08-07T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank BfC for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T21:05:53.405Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-21T15:21:22.416004Z", "id": "CVE-2024-7885", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T15:21:42.735Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241011-0004/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-10-11T22:03:18.905Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241011-0004/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-10-11T22:03:18.905Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-7885", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-21T15:21:22.416004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T15:21:28.865Z"}}], "cna": {"title": "Undertow: improper state management in proxy protocol parsing causes information leakage", "credits": [{"lang": "en", "value": "Red Hat would like to thank BfC for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.2.36.Final", "versionType": "custom"}, {"status": "affected", "version": "2.3.0.Alpha1", "lessThan": "2.3.17.Final", "versionType": "custom"}], "packageName": "undertow", "collectionURL": "https://github.com/undertow-io/undertow", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4.0"], "vendor": "Red Hat", "product": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:3.20.7"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.4.2"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform", "versions": [{"status": "unaffected", "version": "2.2.33.SP2-redhat-00001", "lessThan": "*", "versionType": "rpm"}], "packageName": "io.undertow/undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.11.0-1.redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-apache-commons-beanutils", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.4.11-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-hornetq", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.7.2-19.Final_redhat_00020.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.0.41-5.SP6_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.3.15-5.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-3.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.7.2-20.Final_redhat_00021.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.63-6.Final_redhat_00004.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.0.41-6.SP7_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.3.16-3.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-amazon-ion-java", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-amazon-ion-java", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:camel_spring_boot:3"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel for Spring Boot 3", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:quarkus:3"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus", "packageName": "quarkus-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "vendor": "Red Hat", "product": "Red Hat Data Grid 8", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:camel_k:1"], "vendor": "Red Hat", "product": "Red Hat Integration Camel K 1", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:7"], "vendor": "Red Hat", "product": "Red Hat JBoss Data Grid 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_bpms:7"], "vendor": "Red Hat", "product": "Red Hat Process Automation 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2024-08-16T09:00:41.686Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-08-07T00:00:00.000Z", "value": "Made public."}], "datePublic": "2024-08-07T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:11023", "name": "RHSA-2024:11023", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6508", "name": "RHSA-2024:6508", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6883", "name": "RHSA-2024:6883", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7441", "name": "RHSA-2024:7441", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7442", "name": "RHSA-2024:7442", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7735", "name": "RHSA-2024:7735", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7736", "name": "RHSA-2024:7736", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:8080", "name": "RHSA-2024:8080", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:16667", "name": "RHSA-2025:16667", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0743", "name": "RHSA-2026:0743", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-7885", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290", "name": "RHBZ#2305290", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "Concurrent Execution using Shared Resource with Improper Synchronization"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-04T21:05:53.405Z"}, "x_redhatCweChain": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization"}}, "cveMetadata": {"cveId": "CVE-2024-7885", "state": "PUBLISHED", "dateUpdated": "2026-11-04T21:05:53.405Z", "dateReserved": "2024-08-16T15:35:47.357Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-08-21T14:13:36.579Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/undertow-io/undertow", "defaultStatus": "unaffected", "packageName": "undertow", "versions": [{"lessThan": "2.2.36.Final", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "2.3.17.Final", "status": "affected", "version": "2.3.0.Alpha1", "versionType": "custom"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4.0"], "defaultStatus": "unaffected", "packageName": "undertow", "product": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:3.20.7"], "defaultStatus": "unaffected", "packageName": "undertow", "product": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.4.2"], "defaultStatus": "unaffected", "packageName": "undertow", "product": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "defaultStatus": "affected", "packageName": "io.undertow/undertow-core", "product": "Red Hat JBoss Enterprise Application Platform", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.2.33.SP2-redhat-00001", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "defaultStatus": "unaffected", "product": "Red Hat JBoss Enterprise Application Platform 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-apache-commons-beanutils", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.11.0-1.redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-hornetq", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.4.11-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.7.2-19.Final_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.41-5.SP6_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.3.15-5.GA_redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-3.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.7.2-20.Final_redhat_00021.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.63-6.Final_redhat_00004.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.41-6.SP7_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.3.16-3.GA_redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-amazon-ion-java", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-undertow", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-amazon-ion-java", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-undertow", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_spring_boot:3"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat build of Apache Camel for Spring Boot 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quarkus:3"], "defaultStatus": "unaffected", "packageName": "quarkus-undertow", "product": "Red Hat build of Quarkus", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Data Grid 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_k:1"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Integration Camel K 1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_data_grid:7"], "defaultStatus": "unknown", "packageName": "undertow", "product": "Red Hat JBoss Data Grid 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_bpms:7"], "defaultStatus": "unknown", "packageName": "undertow", "product": "Red Hat Process Automation 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B1DC0F4-BF84-4399-9487-DEF10CEC3D97", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:*:*:*:*:*:*:*", "matchCriteriaId": "EDE67672-8894-448B-84B5-3CD3610A8117", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:*:*:*:*", "matchCriteriaId": "824BB506-D01A-4C88-AD4A-3C94A2409CD2", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3311F2A9-C028-4765-BF79-BC370D15550C", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*", "matchCriteriaId": "B87C8AD3-8878-4546-86C2-BF411876648C", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "72A54BDA-311C-413B-8E4D-388AD65A170A", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0D8BC03A-4198-4488-946B-3F6B43962942", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B40CCE4F-EA2C-453D-BB76-6388767E5C6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "20A6B40D-F991-4712-8E30-5FE008505CB7", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Undertow donde ProxyProtocolReadListener reutiliza la misma instancia de StringBuilder en m\u00faltiples solicitudes. Este problema ocurre cuando el m\u00e9todo parseProxyProtocolV1 procesa m\u00faltiples solicitudes en la misma conexi\u00f3n HTTP. Como resultado, diferentes solicitudes pueden compartir la misma instancia de StringBuilder, lo que podr\u00eda provocar una fuga de informaci\u00f3n entre solicitudes o respuestas. En algunos casos, un valor de una solicitud o respuesta anterior puede reutilizarse por error, lo que podr\u00eda provocar una exposici\u00f3n no deseada de los datos. Este problema produce principalmente errores y terminaci\u00f3n de la conexi\u00f3n, pero crea un riesgo de fuga de datos en entornos de solicitudes m\u00faltiples."}], "id": "CVE-2024-7885", "lastModified": "2026-11-04T21:17:39.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-7885", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-21T15:21:22.416004Z", "version": "2.0.3"}}]}, "published": "2024-08-21T14:15:09.500", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:11023"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:6508"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:6883"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7441"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7442"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7735"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7736"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:8080"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:16667"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:0743"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2024-7885"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241011-0004/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank BfC for reporting this issue.", "affected_release": [{"advisory": "RHSA-2024:11023", "cpe": "cpe:/a:redhat:rhboac_hawtio:4.0.0", "package": "undertow", "product_name": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "release_date": "2024-12-12T00:00:00Z"}, {"advisory": "RHSA-2024:6883", "cpe": "cpe:/a:redhat:apache_camel_spring_boot:3.20.7", "package": "undertow", "product_name": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "release_date": "2024-09-19T00:00:00Z"}, {"advisory": "RHSA-2024:6508", "cpe": "cpe:/a:redhat:apache_camel_spring_boot:4.4.2", "package": "undertow", "product_name": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "release_date": "2024-09-09T00:00:00Z"}, {"advisory": "RHSA-2024:7735", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4", "product_name": "Red Hat JBoss Enterprise Application Platform 7", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "package": "eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "package": "eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9", "package": "eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9", "package": "eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "package": "eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "package": "eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7442", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0", "package": "undertow-core", "product_name": "Red Hat JBoss Enterprise Application Platform 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}], "bugzilla": {"description": "undertow: Improper State Management in Proxy Protocol parsing causes information leakage", "id": "2305290", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-362", "details": ["A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.", "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."], "name": "CVE-2024-7885", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:3", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat build of Apache Camel for Spring Boot 3"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "io.quarkus/quarkus-undertow", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Will not fix", "package_name": "undertow", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Will not fix", "package_name": "undertow", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "undertow", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Out of support scope", "package_name": "undertow", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "undertow-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Out of support scope", "package_name": "undertow", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2024-08-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-7885\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-7885"], "statement": "Red Hat decided to rate this vulnerability as Important because of the potential loss of Availability and no additional privileges being required.", "threat_severity": "Important"}