A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0448 advisory.

  - undertow: client side invocation timeout raised when calling over HTTP2 (CVE-2021-3859)

  - log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender     (CVE-2021-4104)

  - log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

  - log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

  - log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0447 advisory.

  - undertow: client side invocation timeout raised when calling over HTTP2 (CVE-2021-3859)

  - log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender     (CVE-2021-4104)

  - log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

  - log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

  - log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0401 advisory.

  - undertow: client side invocation timeout raised when calling over HTTP2 (CVE-2021-3859)

  - EAP 7: Incomplete fix of CVE-2016-4978 in HornetQ library (CVE-2021-20318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0400 advisory.

  - undertow: client side invocation timeout raised when calling over HTTP2 (CVE-2021-3859)

  - EAP 7: Incomplete fix of CVE-2016-4978 in HornetQ library (CVE-2021-20318)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0405 advisory.

  - undertow: client side invocation timeout raised when calling over HTTP2 (CVE-2021-3859)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
157455	RHEL 8 : Red Hat Single Sign-On 7.5.1 security update on RHEL 8 (Important) (RHSA-2022:0448)	Nessus	Red Hat Local Security Checks	critical
157418	RHEL 7 : Red Hat Single Sign-On 7.5.1 security update on RHEL 7 (Important) (RHSA-2022:0447)	Nessus	Red Hat Local Security Checks	critical
157363	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.3 (RHSA-2022:0401)	Nessus	Red Hat Local Security Checks	high
157337	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.3 (RHSA-2022:0400)	Nessus	Red Hat Local Security Checks	high
157336	RHEL 6 / 7 / 8 : Red Hat JBoss Enterprise Application Platform 7.3 (RHSA-2022:0405)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-3859

high

Tenable Plugins

critical

critical

high

high

high