CVE-2019-19343

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1 are believed to be vulnerable.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "7.2.4"
                }
            ],
            "cpes": [
                "cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "vendor_product": "redhat:jboss_enterprise_application_platform"
        }
    ]
}

References

Affected packages

Git / github.com/jboss-remoting/jboss-remoting

Affected ranges

Type

GIT

Repo

https://github.com/jboss-remoting/jboss-remoting

Events

Introduced

Fixed

f605e1068cbcc20d7993ff1f404d2ed9d65cc9d6

Introduced

f605e1068cbcc20d7993ff1f404d2ed9d65cc9d6

Last affected

f605e1068cbcc20d7993ff1f404d2ed9d65cc9d6

Database specific

{
    "cpe": [
        "cpe:2.3:a:redhat:jboss-remoting:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:redhat:jboss-remoting:5.0.14:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.14"
        },
        {
            "introduced": "5.0.14-NA"
        },
        {
            "last_affected": "5.0.14-NA"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

3.*

3.1.0.Beta2

3.2.0.Beta1

3.2.0.Beta2

3.2.0.Beta3

3.2.0.Beta4

3.2.0.Beta5

3.2.0.Beta6

3.2.0.CR1

3.2.0.CR2

3.2.0.CR3

3.2.0.CR4

3.2.0.CR5

3.2.0.CR6

3.2.0.CR7

3.2.0.CR8

3.2.0.CR9

3.2.0.GA

4.*

4.0.0.Beta1

4.0.0.Beta2

4.0.0.Beta3

4.0.0.Final

5.*

5.0.0.Beta1

5.0.0.Beta10

5.0.0.Beta11

5.0.0.Beta12

5.0.0.Beta13

5.0.0.Beta14

5.0.0.Beta15

5.0.0.Beta16

5.0.0.Beta17

5.0.0.Beta18

5.0.0.Beta19

5.0.0.Beta2

5.0.0.Beta20

5.0.0.Beta21

5.0.0.Beta22

5.0.0.Beta23

5.0.0.Beta24

5.0.0.Beta25

5.0.0.Beta3

5.0.0.Beta4

5.0.0.Beta5

5.0.0.Beta6

5.0.0.Beta7

5.0.0.Beta8

5.0.0.Beta9

5.0.0.CR1

5.0.0.CR2

5.0.0.CR3

5.0.0.CR4

5.0.0.CR5

5.0.0.Final

5.0.1.Final

5.0.14-NA

5.0.14.Final

5.0.2.Final

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19343.json"

Git / github.com/undertow-io/undertow

Affected ranges

Type

GIT

Repo

https://github.com/undertow-io/undertow

Events

Introduced

Fixed

ddf234966f485730e1f48dc461173e0323957478

Introduced

ddf234966f485730e1f48dc461173e0323957478

Last affected

ddf234966f485730e1f48dc461173e0323957478

Database specific

{
    "cpe": [
        "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:redhat:undertow:2.0.25:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.25"
        },
        {
            "introduced": "2.0.25-NA"
        },
        {
            "last_affected": "2.0.25-NA"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

1.*

1.0.0.Alpha1

1.0.0.Alpha10

1.0.0.Alpha11

1.0.0.Alpha12

1.0.0.Alpha13

1.0.0.Alpha14

1.0.0.Alpha15

1.0.0.Alpha16

1.0.0.Alpha17

1.0.0.Alpha18

1.0.0.Alpha19

1.0.0.Alpha2

1.0.0.Alpha20

1.0.0.Alpha21

1.0.0.Alpha22

1.0.0.Alpha3

1.0.0.Alpha4

1.0.0.Alpha5

1.0.0.Alpha6

1.0.0.Alpha7

1.0.0.Alpha8

1.0.0.Alpha9

1.0.0.Beta1

1.0.0.Beta10

1.0.0.Beta11

1.0.0.Beta12

1.0.0.Beta13

1.0.0.Beta14

1.0.0.Beta15

1.0.0.Beta16

1.0.0.Beta17

1.0.0.Beta18

1.0.0.Beta19

1.0.0.Beta2

1.0.0.Beta20

1.0.0.Beta21

1.0.0.Beta22

1.0.0.Beta23

1.0.0.Beta24

1.0.0.Beta25

1.0.0.Beta26

1.0.0.Beta27

1.0.0.Beta28

1.0.0.Beta29

1.0.0.Beta3

1.0.0.Beta30

1.0.0.Beta31

1.0.0.Beta32

1.0.0.Beta33

1.0.0.Beta4

1.0.0.Beta5

1.0.0.Beta6

1.0.0.Beta7

1.0.0.Beta8

1.0.0.Beta9

1.0.0.CR1

1.0.0.CR2

1.0.0.CR3

1.0.0.CR4

1.0.0.Final

1.0.1.Final

1.0.2.Final

1.0.3.Final

1.1.0.Beta1

1.1.0.Beta2

1.1.0.Beta3

1.1.0.Beta4

1.1.0.Beta5

1.1.0.Beta6

1.1.0.Beta7

1.1.0.Beta8

1.2.0.Beta1

1.2.0.Beta10

1.2.0.Beta2

1.2.0.Beta3

1.2.0.Beta4

1.2.0.Beta5

1.2.0.Beta6

1.2.0.Beta7

1.2.0.Beta8

1.2.0.Beta9

1.2.0.CR1

1.2.0.Final

1.2.1.Final

1.2.2.Final

1.2.3.Final

1.2.4.Final

1.3.0.Beta1

1.3.0.Beta10

1.3.0.Beta11

1.3.0.Beta12

1.3.0.Beta13

1.3.0.Beta2

1.3.0.Beta3

1.3.0.Beta4

1.3.0.Beta5

1.3.0.Beta6

1.3.0.Beta7

1.3.0.Beta8

1.3.0.Beta9

1.3.0.CR1

1.3.0.CR2

1.3.0.CR3

1.3.0.Final

1.3.1.Final

1.3.2.Final

1.3.3.Final

2.*

2.0.0.Alpha1

2.0.0.Beta1

2.0.0.Final

2.0.1.Final

2.0.10.Final

2.0.11.Final

2.0.12.Final

2.0.13.Final

2.0.14.Final

2.0.15.Final

2.0.16.Final

2.0.17.Final

2.0.2.Final

2.0.20.Final

2.0.21.Final

2.0.22.Final

2.0.23.Final

2.0.24.Final

2.0.25-NA

2.0.25.Final

2.0.3.Final

2.0.4.Final

2.0.5.Final

2.0.6.Final

2.0.7.Final

2.0.8.Final

2.0.9.Final

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19343.json"