A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0874 advisory.

  - CVE-2021-20220 undertow: Possible regression in fix for (CVE-2020-10687)

  - bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)

  - jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client     (CVE-2020-35510)

  - guava: local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)

  - undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)

  - wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client     (CVE-2021-20250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0873 advisory.

  - CVE-2021-20220 undertow: Possible regression in fix for (CVE-2020-10687)

  - bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)

  - jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client     (CVE-2020-35510)

  - guava: local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)

  - undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)

  - wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client     (CVE-2021-20250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0872 advisory.

  - CVE-2021-20220 undertow: Possible regression in fix for (CVE-2020-10687)

  - bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)

  - jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client     (CVE-2020-35510)

  - guava: local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)

  - undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)

  - wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client     (CVE-2021-20250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3637 advisory.

  - hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

  - jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672, CVE-2020-10673)

  - dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

  - Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests     (CVE-2020-10687)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

  - wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

  - wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

  - wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

  - wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing     Denial of Service (CVE-2020-14307)

  - resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695)

  - EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

  - Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

  - Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

  - jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

  - jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

  - jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

  - jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3639 advisory.

  - hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

  - jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672, CVE-2020-10673)

  - dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

  - Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests     (CVE-2020-10687)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

  - wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

  - wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

  - wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

  - wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing     Denial of Service (CVE-2020-14307)

  - resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695)

  - EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

  - Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

  - Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

  - jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

  - jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

  - jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

  - jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3638 advisory.

  - hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

  - jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672, CVE-2020-10673)

  - dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

  - Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests     (CVE-2020-10687)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

  - wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

  - wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

  - wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

  - wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing     Denial of Service (CVE-2020-14307)

  - resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695)

  - EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

  - Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

  - Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

  - jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

  - jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

  - jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

  - jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3463 advisory.

  - hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

  - jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672, CVE-2020-10673)

  - dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

  - Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests     (CVE-2020-10687)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

  - wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

  - wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

  - netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)

  - wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

  - wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing     Denial of Service (CVE-2020-14307)

  - EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

  - Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3461 advisory.

  - hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

  - jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672, CVE-2020-10673)

  - dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

  - Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests     (CVE-2020-10687)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

  - wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

  - wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

  - netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)

  - wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

  - wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing     Denial of Service (CVE-2020-14307)

  - EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

  - Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3462 advisory.

  - hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

  - jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672, CVE-2020-10673)

  - dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

  - Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests     (CVE-2020-10687)

  - hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

  - wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

  - wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

  - wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

  - netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)

  - wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

  - wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing     Denial of Service (CVE-2020-14307)

  - EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

  - Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
147838	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.6 (RHSA-2021:0874)	Nessus	Red Hat Local Security Checks	high
147837	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.6 (RHSA-2021:0873)	Nessus	Red Hat Local Security Checks	high
147831	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.6 (RHSA-2021:0872)	Nessus	Red Hat Local Security Checks	high
140397	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 (RHSA-2020:3637)	Nessus	Red Hat Local Security Checks	critical
140392	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 (RHSA-2020:3639)	Nessus	Red Hat Local Security Checks	critical
140390	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 (RHSA-2020:3638)	Nessus	Red Hat Local Security Checks	critical
139619	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3463)	Nessus	Red Hat Local Security Checks	critical
139618	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3461)	Nessus	Red Hat Local Security Checks	critical
139616	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3462)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2020-10687

medium

Tenable Plugins

high

high

high

critical

critical

critical

critical

critical

critical