CVE-2020-10705 Allocation of Resources Without Limits or Throttling in Undertow

What is CVE-2020-10705?

CVE-2020-10705 is a high-severity denial of service vulnerability in Netapp Oncommand Insight, published on 10 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

Weakness: CWE-770

Which versions are affected by CVE-2020-10705?

2 open source packages ship an affected version, including io.undertow:undertow-core. It affects 4 products.

Products include Netapp Oncommand Insight, Redhat Jboss Enterprise Application Platform, Redhat Openshift Application Runtimes, Redhat Undertow.

How do I fix CVE-2020-10705?

Upgrade io.undertow:undertow-core to 2.1.1.Final or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-10705 being exploited?

There is no known exploitation of CVE-2020-10705 in the wild and no public exploit code.

Other vulnerabilities in Netapp Oncommand Insight

• CVE-2017-5600 Hardcoded credentials in n/a Critical 9.8
• CVE-2018-1258 Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass High 8.8
• CVE-2020-5421 RFD Protection Bypass via jsessionid High 8.7
• CVE-2022-38733 Auth bypass in OnCommand Insight High 8.6
• CVE-2023-22102 MySQL Connectors takeover vulnerability High 8.3

All Netapp Oncommand Insight vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-10705, GHSA-g4cp-h53p-v3v8, UBUNTU-CVE-2020-10705.