CVE-2022-4492 — Undertow client not checking server identity presented by server certificate in https connections

Description

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

Affected products

Vendor	Product	Affected	Fixed
—	undertow	2.7	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	undertow	2.3.8-2	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	undertow	No fix yet	—
Ubuntu 26.04 LTS	undertow	No fix yet	—
Ubuntu 25.10	undertow	No fix yet	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 24.04 LTS	undertow	No fix yet	—
Ubuntu Pro 22.04 LTS	undertow	No fix yet	—
Ubuntu Pro 20.04 LTS	undertow	No fix yet	—
Ubuntu Pro 18.04 LTS	undertow	No fix yet	—
Ubuntu Pro 16.04 LTS	undertow	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Single Sign On 7	rh-sso7-keycloak +1	18.0.7-1.redhat_00001.1.el7sso	RHSA-2023:2707, RHSA-2023:2706, RHSA-2023:2705
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-glassfish-el +1	3.0.1-4.b08_redhat_00005.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-hibernate +5	5.1.17-3.Final_redhat_00004.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-core +4	2.10.4-3.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-databind	2.8.11.6-3.SP1_redhat_00003.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-datatype-jdk8 +2	2.10.4-2.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-modules-base +1	2.10.4-5.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-ejb-client	4.0.12-1.Final_redhat_00002.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-server-migration +21	1.7.2-16.Final_redhat_00017.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-netty +1	4.1.63-2.Final_redhat_00003.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-undertow	1.4.18-16.SP14_redhat_00001.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly +1	7.1.11-4.GA_redhat_00002.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-elytron	1.1.14-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-elytron-tool	1.10.17-1.Final_redhat_00001.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-http-client +4	1.0.21-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-javadocs +2	7.3.14-3.GA_redhat_00002.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-naming-client	1.0.13-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-openssl +1	1.0.12-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-openssl-linux	1.0.12-6.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat JBoss EAP 7	eap7-activemq-artemis-native	1:1.0.2-3.redhat_00004.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-apache-mime4j	0.8.9-1.redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-artemis-native +1	1:1.0.2-4.redhat_00004.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-artemis-wildfly-integration	1.0.7-1.redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-infinispan +9	11.0.17-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.5.11-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-jboss-ejb-client	4.0.50-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-jboss-el-api_3.0_spec	2.0.1-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-jboss-metadata +5	13.4.0-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-jboss-server-migration +2	1.10.0-26.Final_redhat_00025.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-jbossws-cxf	5.4.8-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-jbossws-spi	3.4.0-2.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-netty +28	4.1.86-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-picketlink-api +7	2.5.5-22.SP12_redhat_00012.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-resteasy +18	3.15.5-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-snakeyaml	1.33.0-2.SP1_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-undertow	2.2.23-1.SP2_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-undertow-jastow	2.0.14-1.Final_redhat_00001.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-wildfly +4	7.4.10-6.GA_redhat_00002.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.1.16-1.Final_redhat_00002.1.el7eap	RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk17	7.4.10-6.GA_redhat_00002.1.el8eap	RHSA-2023:1514, RHSA-2023:1513

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	io.undertow:undertow-core	>= 2.3.0, < 2.3.5.Final	2.3.5.Final	GHSA-pfcc-3g6r-8rg8
Maven	io.undertow:undertow-core	< 2.2.24.Final	2.2.24.Final	GHSA-pfcc-3g6r-8rg8

Advisories 13

RHSA-2025:9583 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:9582 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2023:2706 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:2707 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:2705 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:1514 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:1512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2023:1513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2023-1142 Red Hat Integration Camel for Spring Boot: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
WID-SEC-2023-1193 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 10, 2025
WID-SEC-2023-2679 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
WID-SEC-2023-1755 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2023
WID-SEC-2023-0749 NetApp ActiveIQ Unified Manager: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Mar 26, 2023

Undertow client not checking server identity presented by server certificate in https connections

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

Affected packages

Advisories 13

References