Skip to content
OpenAdvisories
High · 8.6 CVE-2020-1745 EUVD-2022-4009GHSA-gv2w-88hx-8m9r

Improper Authorization in Undertoe

Published Apr 28, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Vendor: undertow-io Product: undertow Package: io.undertow:undertow-core Package: undertow Package: undertow Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

Affected products

VendorProductAffectedFixed
undertow-io undertow <= 2.0.29.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 undertow 2.0.30-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 undertow No fix yet —
Ubuntu 26.04 LTS undertow No fix yet —
Ubuntu 25.10 undertow No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 20.04 LTS undertow No fix yet —
Ubuntu Pro 18.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-commons-beanutils 1.9.4-1.redhat_00002.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-infinispan +5 8.2.11-1.SP2_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.5-1.redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-log4j-jboss-logmanager 1.2.2-1.Final_redhat_00002.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.45-1.Final_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-12.SP12_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.7-2.GA_redhat_00002.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron 1.1.13-1.Final_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-4.redhat_00010.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.2.12-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-bouncycastle +3 1.60.0-2.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-codehaus-jackson +4 1.9.13-10.redhat_00007.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-cryptacular 1.2.4-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-elytron-web +1 1.6.1-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-glassfish-el +1 3.0.1-5.b08_redhat_00004.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-glassfish-javamail 1.6.2-2.redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.5-10.SP3_redhat_00008.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-hal-console 3.0.21-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.16-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-hibernate-commons-annotations 5.0.5-1.Final_redhat_00002.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-hibernate-search +5 5.10.7-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-httpcomponents-client 4.5.4-1.redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-httpcomponents-core 4.4.5-1.redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-infinispan +8 9.4.18-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.20-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jackson-core +9 2.10.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jackson-databind 2.9.10.2-2.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jaegertracing-jaeger-client-java +2 0.34.1-1.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jakarta-el 3.0.3-1.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jandex 2.1.2-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jasypt 1.9.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-javaee-security-soteria +1 1.0.0-3.redhat_00002.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jaxbintros 1.0.3-1.GA_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-classfilewriter 1.2.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-common-beans 2.0.1-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-ejb-api_3.2_spec +1 1.0.2-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.31-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-invocation 1.5.2-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.3_spec 2.3.5-5.SP2_redhat_00003.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-modules 1.8.9-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-openjdk-orb 8.1.4-3.Final_redhat_00002.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.18-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-remoting-jmx 3.0.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-security-negotiation 3.0.6-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-server-migration +23 1.3.1-10.Final_redhat_00011.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-server-migration-eap7.3-server +6 1.7.1-5.Final_redhat_00006.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-threads 2.3.3-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-vfs 3.2.15-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jboss-websocket-api_1.1_spec 1.1.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jboss-weld-3.1-api +2 3.1.0-6.SP2_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-jbossws-common 3.2.3-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jgroups 4.0.20-2.Final_redhat_00002.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jgroups-azure 1.2.1-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-jgroups-kubernetes 1.0.13-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-microprofile-config +1 1.4.0-1.redhat_00003.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-health 2.2.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-metrics +1 2.3.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-opentracing +1 1.3.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-microprofile-rest-client +1 1.4.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-mod_cluster 1.4.1-1.Final_redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.8-1.Final_redhat_00002.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-opensaml +13 3.3.1-1.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.3-7.Final_redhat_00006.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-picketlink-bindings +1 2.5.5-23.SP12_redhat_00012.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-resteasy +19 3.6.1-9.SP8_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-slf4j-jboss-logmanager 1.0.4-1.GA_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-config 1.3.6-1.SP01_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-health 1.0.2-2.redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-metrics 2.4.0-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-smallrye-opentracing 1.3.4-1.redhat_00004.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-snakeyaml 1.24.0-2.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-stax2-api 4.2.0-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-sun-istack-commons +2 3.0.10-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-thrift 0.13.0-1.redhat_00002.1.el6eap RHSA-2020:0962
Red Hat JBoss EAP 7 eap7-txw2 +8 2.3.3-4.b02_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-undertow 2.0.28-4.SP1_redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-weld-cdi-2.0-api 2.0.0-4.SP1_redhat_00004.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.1.4-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly +2 7.2.8-3.GA_redhat_00002.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.6.6-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-elytron-tool 1.10.6-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.20-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.2.8-3.GA_redhat_00002.1.el7eap RHSA-2020:2512, RHSA-2020:2059
Red Hat JBoss EAP 7 eap7-wildfly-naming-client 1.0.12-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-wildfly-openssl +2 1.0.9-2.SP03_redhat_00001.1.el6eap RHSA-2020:0962
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.10-1.Final_redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-woodstox-core 6.0.3-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511
Red Hat JBoss EAP 7 eap7-ws-commons-XmlSchema 2.2.4-1.redhat_00001.1.el6eap RHSA-2020:2060, RHSA-2020:2059, RHSA-2020:2058
Red Hat JBoss EAP 7 eap7-wss4j +6 2.2.5-1.redhat_00001.1.el6eap RHSA-2020:2513, RHSA-2020:2512, RHSA-2020:2511

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.undertow:undertow-core < 2.0.30 2.0.30 GHSA-gv2w-88hx-8m9r

Advisories 12

References