CVE-2020-27782 Denial of service in Undertow

What is CVE-2020-27782?

CVE-2020-27782 is a high-severity denial of service vulnerability in Undertow, published on 23 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

Weakness: CWE-400

Which versions are affected by CVE-2020-27782?

4 open source packages ship an affected version, including io.undertow:undertow-core. It affects 3 products.

Products include Redhat Jboss Fuse, Redhat Openshift Application Runtimes, Redhat Undertow.

How do I fix CVE-2020-27782?

Upgrade io.undertow:undertow-core to a fixed version for your release line: 2.0.33 or 2.1.5.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-27782 being exploited?

There is no known exploitation of CVE-2020-27782 in the wild and no public exploit code.

Other vulnerabilities in Undertow

• CVE-2020-10718 Security feature bypass in Wildfly High 7.5
• CVE-2020-1718 Improper Authentication for Keycloak High 7.1
• CVE-2016-1000229 Improper Neutralization of Input During Web Page Generation in swagger-ui Medium 6.1
• CVE-2014-8175 Auth bypass in n/a Medium 6.0
• CVE-2020-10734 OIDC Logout redirect in keycloak Low 3.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-27782, GHSA-rhcw-wjcm-9h6g, UBUNTU-CVE-2020-27782.