CVE-2020-27782

Description

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v2.0•HIGH•Score: 7.8AV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 0.18%• Percentile: 40%

Techniques & Countermeasures

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

• debian•undertow

  < 2.2.4-1

• io.undertow•undertow-core

  ≥ 2.1.0, < 2.1.5 | < 2.0.33

• redhat•jboss_fuse

  6.0.0 | 7.0.0

• redhat•openshift_application_runtimes

  na

• redhat•undertow

  2.0.33:sp2 | 2.1.5:sp1 | 2.2.3:sp1

References (5)

• https://bugzilla.redhat.com/show_bug.cgi?id=1901304
• https://security-tracker.debian.org/tracker/CVE-2020-27782
• https://nvd.nist.gov/vuln/detail/CVE-2020-27782
• https://github.com/undertow-io/undertow/pull/997/commits/98a9ab7f2d7fe7a7254eaf17d47816c452169c90
• https://issues.redhat.com/browse/UNDERTOW-1813