Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-3653

Undertow: learningpushhandler can lead to remote memory dos attacks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

undertow

Default version status: unaffected

  • 0 to ≤ 2.3.14.Finalaffected

Red Hat Red Hat build of Quarkus 3.8.6.redhat

Default version status: affected

  • 5.2.4.redhat-00001 to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform

Default version status: affected

  • 2.2.33.SP1-redhat-00001 to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Default version status: affected

  • 0:2.2.33-1.SP1_redhat_00001.1.el8eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Default version status: affected

  • 0:2.2.33-1.SP1_redhat_00001.1.el9eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Default version status: affected

  • 0:2.2.33-1.SP1_redhat_00001.1.el7eap to < *unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: unaffected

Red Hat OpenShift Serverless

Default version status: affected

Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

Default version status: affected

Red Hat Red Hat build of Apache Camel for Spring Boot 4

Default version status: affected

Red Hat Red Hat build of Apache Camel - HawtIO 4

Default version status: unaffected

Red Hat Red Hat build of Apicurio Registry 2

Default version status: unaffected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

Red Hat Red Hat build of OptaPlanner 8

Default version status: affected

Red Hat Red Hat build of Quarkus

Default version status: unaffected

Red Hat Red Hat Data Grid 8

Default version status: affected

Red Hat Red Hat Fuse 7

Default version status: unknown

Red Hat Red Hat Integration Camel K 1

Default version status: affected

Red Hat Red Hat Integration Camel Quarkus 2

Default version status: affected

Red Hat Red Hat JBoss Data Grid 7

Default version status: unknown

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: unaffected

Red Hat Red Hat JBoss Fuse Service Works 6

Default version status: unknown

Red Hat Red Hat Process Automation 7

Default version status: unknown

Red Hat Red Hat Single Sign-On 7

Default version status: affected

Red Hat streams for Apache Kafka

Default version status: affected

References