| Package | Affected versions | Patched versions |
|---|---|---|
| io.undertow:undertow-core | ≥ 2.3.0, < 2.3.5.Final< 2.2.24.Final | 2.3.5.Final2.2.24.Final |
| jboss enterprise application platform | = 7.0.0 | |
| jboss fuse | = 7.0.0 | |
| migration toolkit for applications | = 6.0 | |
| single sign-on | = 7.0 | |
| undertow | = 2.7.0 |
The undertow client is not checking the server identity presented by the server certificate in https connections. This should be performed by default in https and in http/2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free