CVE-2022-4492
EUVD-2023-075923.02.2023, 20:15
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | build_of_quarkus | - |
| redhat | integration_camel_for_spring_boot | - |
| redhat | integration_camel_k | - |
| redhat | integration_service_registry | - |
| redhat | jboss_enterprise_application_platform | 7.0.0 |
| redhat | jboss_fuse | 7.0.0 |
| redhat | migration_toolkit_for_applications | 6.0 |
| redhat | migration_toolkit_for_runtimes | - |
| redhat | single_sign-on | 7.0 |
| redhat | undertow | 2.7.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
References