VDB
RHSA-2023%3A3813
RHSA-2023%3A3813
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step ( that should at least be performed by default) in HTTPS and in http/2.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-rhel8-operator@sha256:12e80abe7c02cfbd1a179cb304bef58b72729f5821113c98e2230dda517ef4ec_ppc64le |
| Red Hat | mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-operator-bundle@sha256:70c1c24245ce7975c50055f0a9f616cd9db4a6325c9aadc42e80a7618b7a74dd_ppc64le |
| Red Hat | mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-rhel8-operator@sha256:f9b5c11144415597762706d93d1f90b2b684dbcab4dd5b83204831d0a3bf529f_s390x |
| Red Hat | mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-web-executor-container-rhel8@sha256:be070c36939408f3ebe40612e239be07ea495d3a4f838e84db43e2d73dc3987f_amd64 |
| Red Hat | mtr/mtr-web-container-rhel8@sha256:bc3f7a7cda2b40adc2561c3dd7e2193d1da899ad6a499713bf54f4cfa8055f20_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | * |
| Red Hat | mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-web-container-rhel8@sha256:fd35bbd776cd186298a621f8122cdaa059dfa0d480eae08127e963faa5e26680_s390x |
| Red Hat | mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-web-container-rhel8@sha256:74c5ddfc32d28a9f7a08364910413ffcae2453faaded21befcf28840414c968b_ppc64le |
| Red Hat | mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-operator-bundle@sha256:e43184e29882918430c515933e4669185cb49764bed4ef5da7ce2580f0a79ecd_amd64 |
| Red Hat | mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-web-executor-container-rhel8@sha256:dedc08bd847e3dfe8c3789ed17844f15e75edf3a4bf8786f6a7f897f6ca66d7f_arm64 |
| Red Hat | mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-operator-bundle@sha256:6e4522f5ec12c49e5aad88536accb10eef503e1cabc1abad07ae7a746c03c676_arm64 |
| Red Hat | mtr/mtr-web-executor-container-rhel8@sha256:42ff12e2c4d6308a6a5d7cb262c7b20e6c2df43542249edc327a35ecccbf21e4_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | * |
| Red Hat | mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-web-executor-container-rhel8@sha256:5c27fad928e344f4b26b6fb68b3c21adfe695ee1707063d959fa722d72d7eef1_ppc64le |
| Red Hat | mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-operator-bundle@sha256:8b608899c571a4729a241f041bfaa65c183c9e81dc1731e650f0db84c24fc274_s390x |
| Red Hat | mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-rhel8-operator@sha256:6f2d9ac73482bc381c3f87590954ecb0632ccfe3c50b1f96d9f637d1e60101b3_arm64 |
| Red Hat | mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8 | mtr/mtr-rhel8-operator@sha256:93db684ab05b08d7a6b55e19e63934b85a758bc0b29b9c49469278ce9f6b456e_amd64 |
Timeline
- Jun 27, 2023 CVE Published
- Mar 18, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2023:3813 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2153260 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3813.json advisory
- https://access.redhat.com/security/cve/CVE-2022-4492 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-4492 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-4492 advisory