The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2022-4492 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2153260 | Issue Tracking Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20230324-0002/ | |
| https://access.redhat.com/security/cve/CVE-2022-4492 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2153260 | Issue Tracking Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20230324-0002/ |
Configurations
Configuration 1 (hide)
|
History
12 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-918 |
21 Nov 2024, 07:35
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/CVE-2022-4492 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2153260 - Issue Tracking, Vendor Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20230324-0002/ - |
24 Mar 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2023-02-23 20:15
Updated : 2025-03-12 15:15
NVD link : CVE-2022-4492
Mitre link : CVE-2022-4492
CVE.ORG link : CVE-2022-4492
JSON object : View
Products Affected
redhat
- undertow
- migration_toolkit_for_runtimes
- integration_camel_for_spring_boot
- jboss_enterprise_application_platform
- migration_toolkit_for_applications
- single_sign-on
- integration_service_registry
- build_of_quarkus
- jboss_fuse
- integration_camel_k
CWE