CVE-2022-2764 Denial of service in undertow
Attackers can cause a denial of service in Undertow by triggering indefinite waits during EJB invocations, affecting server availability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2764?
CVE-2022-2764 is a medium-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 1 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.
Weakness: CWE-400
Which versions are affected by CVE-2022-2764?
It affects 9 products.
Linux distribution packages (3)
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.4::el7 | All versions | 0:2.2.20-1.SP1_redhat_00001.1.el7eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:2.2.20-1.SP1_redhat_00001.1.el8eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:2.2.20-1.SP1_redhat_00001.1.el9eap |
Products include Netapp Active Iq Unified Manager, Netapp Cloud Secure Agent, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Redhat Integration Camel K, Redhat Jboss Enterprise Application Platform and 3 more.
How do I fix CVE-2022-2764?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-2764 being exploited?
There is no known exploitation of CVE-2022-2764 in the wild and no public exploit code.
Other vulnerabilities in Netapp Active Iq Unified Manager
Sources
Also known as DEBIAN-CVE-2022-2764, GHSA-xpxq-cp94-87j2, RHSA-2022:8790, RHSA-2022:8791, RHSA-2022:8792, UBUNTU-CVE-2022-2764.