CVE-2024-4109: undertow

CVSS: 7.5v3.1HighRejected

AliasesRHSA-2024:10927RHSA-2024:10928RHSA-2024:10929+2 more

Published 12-12-2024Last modified 16-01-2025

Open JSON

Rejected

This record was rejected and should not be used. The data below is kept for reference.

Vulnerability summary

CVE-2024-4109 is a high (CVSS 7.5) vulnerability in undertow.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (OSV · Ubuntu), selected by version preference

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4

RHSA-2024:11559 RHSA-2024:11560 RHSA-2025:16667 RHSA-2025:16668

Timeline

12-12-2024
PublishedVulnerability first disclosed.
16-01-2025
Last modifiedVulnerability information updated.

Description

Rejected reason: Red Hat Product Security has determined that this CVE is not a security vulnerability.

CVSS metrics

2 scores · 2 sources · 1 version

v3.17.5

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Redhat59 products

eap7-activemq-artemis< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-cli< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-commons< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-core-client< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-dto< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap

eap7-activemq-artemis-hornetq-protocol< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-hqclient-protocol< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-jdbc-store< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-jms-client< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-jms-server< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-journal< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-ra< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-selector< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-server< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-service-extensions< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-activemq-artemis-tools< 0:2.16.0-19.redhat_00053.1.el7eap | < 0:2.16.0-19.redhat_00053.1.el8eap | < 0:2.16.0-19.redhat_00053.1.el9eap
eap7-byte-buddy< 0:1.11.12-3.redhat_00003.1.el7eap | < 0:1.11.12-3.redhat_00003.1.el8eap | < 0:1.11.12-3.redhat_00003.1.el9eap
eap7-jaxen< 0:1.1.6-15.redhat_00003.1.el7eap | < 0:1.1.6-15.redhat_00003.1.el8eap | < 0:1.1.6-15.redhat_00003.1.el9eap
eap7-jboss-ejb-client< 0:4.0.56-1.Final_redhat_00001.1.el7eap | < 0:4.0.56-1.Final_redhat_00001.1.el8eap | < 0:4.0.56-1.Final_redhat_00001.1.el9eap
eap7-jboss-remoting< 0:5.0.30-1.Final_redhat_00001.1.el7eap | < 0:5.0.30-1.Final_redhat_00001.1.el8eap | < 0:5.0.30-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration< 0:1.10.0-40.Final_redhat_00040.1.el7eap | < 0:1.10.0-40.Final_redhat_00040.1.el8eap | < 0:1.10.0-40.Final_redhat_00040.1.el9eap
eap7-jboss-server-migration-cli< 0:1.10.0-40.Final_redhat_00040.1.el7eap | < 0:1.10.0-40.Final_redhat_00040.1.el8eap | < 0:1.10.0-40.Final_redhat_00040.1.el9eap
eap7-jboss-server-migration-core< 0:1.10.0-40.Final_redhat_00040.1.el7eap | < 0:1.10.0-40.Final_redhat_00040.1.el8eap | < 0:1.10.0-40.Final_redhat_00040.1.el9eap
eap7-jbossws-cxf< 0:5.4.13-1.Final_redhat_00001.1.el7eap | < 0:5.4.13-1.Final_redhat_00001.1.el8eap | < 0:5.4.13-1.Final_redhat_00001.1.el9eap
eap7-log4j-jboss-logmanager< 0:1.3.1-2.Final_redhat_00003.1.el7eap | < 0:1.3.1-2.Final_redhat_00003.1.el8eap | < 0:1.3.1-2.Final_redhat_00003.1.el9eap
eap7-picketlink-bindings< 0:2.5.5-28.SP12_redhat_00017.1.el7eap | < 0:2.5.5-28.SP12_redhat_00017.1.el8eap | < 0:2.5.5-28.SP12_redhat_00017.1.el9eap
eap7-picketlink-wildfly8< 0:2.5.5-28.SP12_redhat_00017.1.el7eap | < 0:2.5.5-28.SP12_redhat_00017.1.el8eap | < 0:2.5.5-28.SP12_redhat_00017.1.el9eap
eap7-resteasy< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-atom-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-cdi< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-client< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-crypto< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-jackson-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-jackson2-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-jaxb-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-jaxrs< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-jettison-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-jose-jwt< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-jsapi< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-json-binding-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-json-p-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-multipart-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-rxjava2< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-spring< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-validator-provider-11< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy-yaml-provider< 0:3.15.10-1.Final_redhat_00001.1.el7eap | < 0:3.15.10-1.Final_redhat_00001.1.el8eap | < 0:3.15.10-1.Final_redhat_00001.1.el9eap
eap7-undertow< 0:2.2.37-1.SP2_redhat_00001.1.el7eap | < 0:2.2.37-1.SP2_redhat_00001.1.el8eap | < 0:2.2.37-1.SP2_redhat_00001.1.el9eap
eap7-wildfly< 0:7.4.20-2.GA_redhat_00001.1.el7eap | < 0:7.4.20-2.GA_redhat_00001.1.el8eap | < 0:7.4.20-2.GA_redhat_00001.1.el9eap
eap7-wildfly-http-client< 0:1.1.18-1.Final_redhat_00001.1.el7eap | < 0:1.1.18-1.Final_redhat_00001.1.el8eap | < 0:1.1.18-1.Final_redhat_00001.1.el9eap
eap7-wildfly-http-client-common< 0:1.1.18-1.Final_redhat_00001.1.el7eap | < 0:1.1.18-1.Final_redhat_00001.1.el8eap | < 0:1.1.18-1.Final_redhat_00001.1.el9eap
eap7-wildfly-http-ejb-client< 0:1.1.18-1.Final_redhat_00001.1.el7eap | < 0:1.1.18-1.Final_redhat_00001.1.el8eap | < 0:1.1.18-1.Final_redhat_00001.1.el9eap
eap7-wildfly-http-naming-client< 0:1.1.18-1.Final_redhat_00001.1.el7eap | < 0:1.1.18-1.Final_redhat_00001.1.el8eap | < 0:1.1.18-1.Final_redhat_00001.1.el9eap
eap7-wildfly-http-transaction-client< 0:1.1.18-1.Final_redhat_00001.1.el7eap | < 0:1.1.18-1.Final_redhat_00001.1.el8eap | < 0:1.1.18-1.Final_redhat_00001.1.el9eap
eap7-wildfly-java-jdk11< 0:7.4.20-2.GA_redhat_00001.1.el7eap | < 0:7.4.20-2.GA_redhat_00001.1.el8eap | < 0:7.4.20-2.GA_redhat_00001.1.el9eap
eap7-wildfly-java-jdk17< 0:7.4.20-2.GA_redhat_00001.1.el8eap | < 0:7.4.20-2.GA_redhat_00001.1.el9eap
eap7-wildfly-java-jdk8< 0:7.4.20-2.GA_redhat_00001.1.el7eap | < 0:7.4.20-2.GA_redhat_00001.1.el8eap | < 0:7.4.20-2.GA_redhat_00001.1.el9eap
eap7-wildfly-javadocs< 0:7.4.20-2.GA_redhat_00001.1.el7eap | < 0:7.4.20-2.GA_redhat_00001.1.el8eap | < 0:7.4.20-2.GA_redhat_00001.1.el9eap
eap7-wildfly-modules< 0:7.4.20-2.GA_redhat_00001.1.el7eap | < 0:7.4.20-2.GA_redhat_00001.1.el8eap | < 0:7.4.20-2.GA_redhat_00001.1.el9eap
eap7-woodstox-core< 0:6.4.0-2.redhat_00003.1.el7eap | < 0:6.4.0-2.redhat_00003.1.el8eap | < 0:6.4.0-2.redhat_00003.1.el9eap

Show all 59

Debian1 product

undertowAll versions (No fix recorded)

Io.undertow1 product

undertow-core≤ 2.3.18.Final

Ubuntu1 product

undertowAll versions (No fix recorded)

4 vendors · 62 products

References

37 links

access.redhat.com/errata/RHSA-2024:10927AdvisoryWEB
access.redhat.com/security/updates/classification/ARTICLE
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4ARTICLE
docs.redhat.com/en/…ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2272325REPORTWEB
issues.redhat.com/browse/JBEAP-27637ARTICLE
issues.redhat.com/browse/JBEAP-27647ARTICLE
issues.redhat.com/browse/JBEAP-28050ARTICLE
issues.redhat.com/browse/JBEAP-28107ARTICLE
issues.redhat.com/browse/JBEAP-28132ARTICLE

Show all 37 references

issues.redhat.com/browse/JBEAP-28183ARTICLE
issues.redhat.com/browse/JBEAP-28192ARTICLE
issues.redhat.com/browse/JBEAP-28238ARTICLE
issues.redhat.com/browse/JBEAP-28263ARTICLE
issues.redhat.com/browse/JBEAP-28267ARTICLE
issues.redhat.com/browse/JBEAP-28268ARTICLE
issues.redhat.com/browse/JBEAP-28270ARTICLE
issues.redhat.com/browse/JBEAP-28277ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10927.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-4109REPORTWEB
www.cve.org/CVERecord?id=CVE-2024-4109AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-4109Advisory
github.com/undertow-io/undertow/pull/1668ARTICLE
access.redhat.com/errata/RHSA-2024:10928AdvisoryWEB
issues.redhat.com/browse/JBEAP-27638ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10928.jsonAdvisory
access.redhat.com/errata/RHSA-2024:10929AdvisoryWEB
issues.redhat.com/browse/JBEAP-27639ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10929.jsonAdvisory
ubuntu.com/security/CVE-2024-4109REPORT
security-tracker.debian.org/tracker/CVE-2024-4109Advisory
access.redhat.com/errata/RHSA-2024:10933WEB
access.redhat.com/errata/RHSA-2024:11559WEB
access.redhat.com/errata/RHSA-2024:11560WEB
access.redhat.com/errata/RHSA-2024:11570WEB
github.com/undertow-io/undertowPACKAGE
github.com/undertow-io/…WEB