VDB
RHSA-2022%3A6825
RHSA-2022%3A6825
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | org.wildfly.transaction.wildfly-transaction-client-1.1.15.Final-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform | * |
| Red Hat | None.assign-symbols-1.0.0 as a component of Red Hat JBoss Enterprise Application Platform | None.assign-symbols-1.0.0 |
| Red Hat | org.glassfish.jaxb.jaxb-xjc-2.3.3.b02-redhat-00001.pom as a component of Red Hat JBoss Enterprise Application Platform | org.glassfish.jaxb.jaxb-xjc-2.3.3.b02-redhat-00001.pom |
| Red Hat | org.jboss.eap.wildfly-clustering-api-7.4.7.GA-redhat-00003.jar as a component of Red Hat JBoss Enterprise Application Platform | org.jboss.eap.wildfly-clustering-api-7.4.7.GA-redhat-00003.jar |
| Red Hat | org.jboss.resteasy.resteasy-rxjava2-3.15.4.Final-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform | org.jboss.resteasy.resteasy-rxjava2-3.15.4.Final-redhat-00001.jar |
| Red Hat | org.wildfly.security.wildfly-elytron-realm-1.15.14.Final-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform | org.wildfly.security.wildfly-elytron-realm-1.15.14.Final-redhat-00001.jar |
| Red Hat | com.sun.faces.jsf-impl-2.3.14.SP06-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform | * |
| Red Hat | org.jboss.eap.wildfly-jsf-7.4.7.GA-redhat-00003.jar as a component of Red Hat JBoss Enterprise Application Platform | org.jboss.eap.wildfly-jsf-7.4.7.GA-redhat-00003.jar |
| Red Hat | org.jboss.narayana.rts.restat-integration-5.11.4.Final-redhat-00001.pom as a component of Red Hat JBoss Enterprise Application Platform | org.jboss.narayana.rts.restat-integration-5.11.4.Final-redhat-00001.pom |
| Red Hat | None.domelementtype-1.3.1 as a component of Red Hat JBoss Enterprise Application Platform | * |
| Red Hat | org.wildfly.security.wildfly-elytron-x500-cert-1.15.14.Final-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform | * |
| Red Hat | None.bootstrap-touchspin-3.1.1 as a component of Red Hat JBoss Enterprise Application Platform | * |
| Red Hat | org.jboss.jboss-transaction-spi-7.6.0.Final-redhat-1.pom as a component of Red Hat JBoss Enterprise Application Platform | * |
| Red Hat | org.jboss.eap.wildfly-clustering-singleton-api-7.4.7.GA-redhat-00003.jar as a component of Red Hat JBoss Enterprise Application Platform | org.jboss.eap.wildfly-clustering-singleton-api-7.4.7.GA-redhat-00003.jar |
| Red Hat | None.bootstrap-3.4.1 as a component of Red Hat JBoss Enterprise Application Platform | None.bootstrap-3.4.1 |
| Red Hat | None.markdown-escapes-1.0.3 as a component of Red Hat JBoss Enterprise Application Platform | * |
| Red Hat | org.wildfly.security.wildfly-elytron-jaspi-1.15.14.Final-redhat-00001.pom as a component of Red Hat JBoss Enterprise Application Platform | org.wildfly.security.wildfly-elytron-jaspi-1.15.14.Final-redhat-00001.pom |
| Red Hat | org.codehaus.jettison.jettison-1.4.0.redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform | org.codehaus.jettison.jettison-1.4.0.redhat-00001.jar |
| Red Hat | com.fasterxml.classmate-1.5.1.redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform | com.fasterxml.classmate-1.5.1.redhat-00001.jar |
| Red Hat | io.agroal.agroal-narayana-1.3.0.redhat-00001.pom as a component of Red Hat JBoss Enterprise Application Platform | * |
…and 2098 more
Timeline
- Oct 5, 2022 CVE Published
- Apr 30, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2022:6825 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4 advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2072339 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2095862 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2126789 issue
- https://issues.redhat.com/browse/JBEAP-23687 advisory
- https://issues.redhat.com/browse/JBEAP-23738 advisory
- https://issues.redhat.com/browse/JBEAP-23741 advisory
- https://issues.redhat.com/browse/JBEAP-23753 advisory
- https://issues.redhat.com/browse/JBEAP-23772 advisory
- https://issues.redhat.com/browse/JBEAP-23794 advisory
- https://issues.redhat.com/browse/JBEAP-23802 advisory
- https://issues.redhat.com/browse/JBEAP-23803 advisory
- https://issues.redhat.com/browse/JBEAP-23805 advisory
- https://issues.redhat.com/browse/JBEAP-23816 advisory
- https://issues.redhat.com/browse/JBEAP-23818 advisory
- https://issues.redhat.com/browse/JBEAP-23869 advisory
- https://issues.redhat.com/browse/JBEAP-23881 advisory
…and 12 more