Skip to content
OpenAdvisories
Medium · 5.3 CVE-2019-3888 EUVD-2019-0546GHSA-jwgx-9mmh-684w

Credential exposure through log files in Undertow

Published Jun 12, 2019 · Updated Aug 4, 2024 · Assigned by redhat

Vendor: Red Hat Product: undertow Package: io.undertow:undertow-core Package: undertow Package: undertow Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

Affected products

VendorProductAffectedFixed
Red Hat undertow 2.0.21 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 undertow 2.0.23-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 undertow No fix yet —
Ubuntu 26.04 LTS undertow No fix yet —
Ubuntu 25.10 undertow No fix yet —
Ubuntu 20.04 LTS undertow 2.0.23-1 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 18.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 rhvm-appliance 2:4.3-20190722.0.el7 RHSA-2019:2439
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-apache-commons-codec 1.11.0-2.redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.2.7-2.redhat_00002.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-hal-console 3.0.11-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.10-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-hornetq +3 2.4.7-7.Final_redhat_2.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.16-2.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-javassist 3.23.2-2.GA_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.18-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jboss-marshalling +1 2.0.7-2.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jboss-modules 1.8.8-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jboss-openjdk-orb 8.1.3-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.9-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jboss-server-migration +23 1.3.1-2.Final_redhat_00002.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.6.6-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-jgroups 4.0.19-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-picketlink-api +9 2.5.5-17.SP12_redhat_00005.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-resteasy +19 3.6.1-5.SP5_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-undertow 2.0.20-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.0.6-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-wildfly +2 7.2.2-2.GA_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-wildfly-common 1.5.1-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-wildfly-discovery +1 1.1.2-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.15-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.2.2-2.GA_redhat_00001.1.el7eap RHSA-2019:1420
Red Hat JBoss EAP 7 eap7-wildfly-naming-client 1.0.10-1.Final_redhat_00001.1.el6eap RHSA-2019:1421, RHSA-2019:1420, RHSA-2019:1419

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.undertow:undertow-core < 2.0.21 2.0.21 GHSA-jwgx-9mmh-684w

Advisories 5

References