CVE-2024-7885 Undertow: improper state management in proxy protocol parsing causes information leakage
Improper state management in Undertow's proxy protocol parsing allows information leakage between requests due to shared StringBuilder instances.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-7885?
CVE-2024-7885 is a high-severity vulnerability in Redhat Build of Keycloak, published on 21 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
Weakness: CWE-362
Which versions are affected by CVE-2024-7885?
4 open source packages ship an affected version, including io.undertow:undertow-core. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
io.undertow:undertow-core Maven | All versions | 2.2.36.Final |
io.undertow:undertow-core Maven | All versions | 2.2.36.Final |
io.undertow:undertow-core Maven | From 2.3.0.Alpha1 | 2.3.17.Final |
io.undertow:undertow-core Maven | From 2.3.0.Alpha1 | 2.3.17.Final |
Linux distribution packages (20)
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.4::el7 | All versions | 0:2.2.33-2.SP2_redhat_00001.1.el7eap |
eap7-wildfly Red Hat:jboss_enterprise_application_platform:7.4::el7 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el7eap |
eap7-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform:7.4::el7 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el7eap |
eap7-wildfly-java-jdk8 Red Hat:jboss_enterprise_application_platform:7.4::el7 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el7eap |
eap7-wildfly-javadocs Red Hat:jboss_enterprise_application_platform:7.4::el7 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el7eap |
eap7-wildfly-modules Red Hat:jboss_enterprise_application_platform:7.4::el7 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el7eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:2.2.33-2.SP2_redhat_00001.1.el8eap |
eap7-wildfly Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el8eap |
eap7-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el8eap |
eap7-wildfly-java-jdk17 Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el8eap |
eap7-wildfly-java-jdk8 Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el8eap |
eap7-wildfly-javadocs Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el8eap |
eap7-wildfly-modules Red Hat:jboss_enterprise_application_platform:7.4::el8 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el8eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:2.2.33-2.SP2_redhat_00001.1.el9eap |
eap7-wildfly Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el9eap |
eap7-wildfly-java-jdk11 Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el9eap |
eap7-wildfly-java-jdk17 Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el9eap |
eap7-wildfly-java-jdk8 Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el9eap |
eap7-wildfly-javadocs Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el9eap |
eap7-wildfly-modules Red Hat:jboss_enterprise_application_platform:7.4::el9 | All versions | 0:7.4.18-1.GA_redhat_00003.1.el9eap |
Products include Redhat Build of Apache Camel - Hawtio, Redhat Build of Apache Camel for Spring Boot, Redhat Build of Keycloak, Redhat Data Grid, Redhat Integration Camel K, Redhat Jboss Enterprise Application Platform and 3 more.
How do I fix CVE-2024-7885?
Upgrade io.undertow:undertow-core to a fixed version for your release line: 2.2.36.Final or 2.3.17.Final.
Is CVE-2024-7885 being exploited?
There is no known exploitation of CVE-2024-7885 in the wild and no public exploit code.
Other vulnerabilities in Redhat Build of Keycloak
Sources
Also known as CLSA-2025-1762992412, DEBIAN-CVE-2024-7885, GHSA-9623-mqmm-5rcf, RHSA-2024:7736, UBUNTU-CVE-2024-7885.