CVE-2022-1319

HIGH

Undertow - Info Disclosure

Title source: llm

Description

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

References (6)

[Vendor Advisory] https://access.redhat.com/security/cve/CVE-2022-1319

[Issue Tracking, Vendor Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=2073890

[Patch, Third Party Advisory] https://github.com/undertow-io/undertow/commit/1443a1a2bbb8e32e56788109d8285db250d55c8b

[Patch, Third Party Advisory] https://github.com/undertow-io/undertow/commit/7c5b3ab885b5638fd3f1e8a935d5063d68aa2df3

View Patch ZIP pw:eip

[Issue Tracking, Vendor Advisory] https://issues.redhat.com/browse/UNDERTOW-2060

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20221014-0006/

Scores

CVSS v3 7.5

EPSS 0.0119

EPSS Percentile 78.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-252

Status published

Affected Products (15)

redhat/openshift_application_runtimes

redhat/single_sign-on

redhat/undertow < 2.2.17

redhat/undertow

redhat/undertow

redhat/undertow

redhat/undertow

redhat/undertow

redhat/undertow

netapp/active_iq_unified_manager

netapp/active_iq_unified_manager

netapp/active_iq_unified_manager

netapp/cloud_secure_agent

netapp/oncommand_insight

netapp/oncommand_workflow_automation

Timeline

Published Aug 31, 2022

Tracked Since Feb 18, 2026