SB20240618107 - Red Hat JBoss Enterprise Application Platform update for undertow
Published: June 18, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2023-4639)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient validation of cookies with certain value-delimiting characters in incoming requests. A remote attacker can construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification.
2) Path traversal (CVE-ID: CVE-2024-1459)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
3) Resource exhaustion (CVE-ID: CVE-2023-1973)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to server does not properly control consumption of internal resources when handling HTTP requests. A remote attacker can send specially crafted HTTP requests to the server to trigger resource exhaustion and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.