CVE-2019-14888

Description

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.24%• Percentile: 48%

Techniques & Countermeasures

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

• io.undertow•undertow-core

  < 2.0.29.Final

• netapp•active_iq_unified_manager

  na

• red hat•undertow

  All versions before 2.0.28.SP1

• redhat•jboss_data_grid

  na | 7.0.0

• redhat•jboss_enterprise_application_platform

  7.0.0

• redhat•jboss_fuse

  6.0.0 | 7.0.0

• redhat•single_sign-on

  7.0

• redhat•undertow

  ≤ 2.0.28

References (5)

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888
• https://access.redhat.com/errata/RHSA-2020:0729
• https://security.netapp.com/advisory/ntap-20220211-0001/
• https://nvd.nist.gov/vuln/detail/CVE-2019-14888
• https://security.netapp.com/advisory/ntap-20220211-0001