CVE-2024-7885 Undertow: improper state management in proxy protocol parsing causes information leakage
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
Problem types: cwe_id: CWE-362
description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: default_status: unaffected
vendor: Red Hat
product: HawtIO 4.0.0 for Red Hat build of Apache Camel 4
cpes: cpe:/a:redhat:rhboac_hawtio:4.0.0
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apache Camel 3.20.7 for Spring Boot
cpes: cpe:/a:redhat:apache_camel_spring_boot:3.20.7
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apache Camel 4.4.2 for Spring Boot
cpes: cpe:/a:redhat:apache_camel_spring_boot:4.4.2
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Apache Camel for Spring Boot 3
cpes: cpe:/a:redhat:camel_spring_boot:3
default_status: affected
vendor: Red Hat
product: Red Hat build of Apache Camel - HawtIO 4
cpes: cpe:/a:redhat:apache_camel_hawtio:4
default_status: affected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
vendor: Red Hat
product: Red Hat build of Quarkus
cpes: cpe:/a:redhat:quarkus:3
default_status: unaffected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: affected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: affected
vendor: Red Hat
product: Red Hat Integration Camel K 1
cpes: cpe:/a:redhat:integration:1
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
cpes: cpe:/a:redhat:jboss_data_grid:7
default_status: unknown
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: unknown
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank BfC for reporting this issue.
Published: 2024-08-21T14:13:36.579Z