Credential exposure through log files in Undertow

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-3888 · ADVISORY
• access.redhat.com/errata/RHSA-2019:2439 · WEB
• access.redhat.com/errata/RHSA-2019:2998 · WEB
• access.redhat.com/errata/RHSA-2020:0727 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• security.netapp.com/advisory/ntap-20220210-0019 · WEB
• securityfocus.com/bid/108739 · WEB
• security.netapp.com/advisory/ntap-20220210-0019 · Third Party Advisory

io.undertow:undertow-core のその他の脆弱性

• CVE-2024-4027高 7.5A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError wh…
• CVE-2025-12543緊急 9.6A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fa…
• CVE-2024-3884高 7.5A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(Str…
• CVE-2025-9784高 7.5A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This i…
• CVE-2023-4639高 7.4A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue cou…