Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

The version of undertow is vulnerable to CVE-2019-10184 #3442

Closed
loicmathieu opened this issue Aug 7, 2019 · 1 comment
Closed

The version of undertow is vulnerable to CVE-2019-10184 #3442

loicmathieu opened this issue Aug 7, 2019 · 1 comment
Assignees
@stuartwdouglas
Labels
kind/bug Something isn't working
Milestone
0.21.0

Comments

@loicmathieu
Copy link
Contributor

Describe the bug
The current version of undertow, the 2.0.21.Final, contains a know vulnerabilities CVE-2019-10184 (https://nvd.nist.gov/vuln/detail/CVE-2019-10184) that has a CVSS Score v3 of 7.5 - HIGH.

Expected behavior
No CVE with a high score for undertow.

Actual behavior
One CVE with a high score is found for undertow.

To Reproduce
Steps to reproduce the behavior:

  1. You can use the maven OWASP dependency-check to analyse the current Quarkus libraries for known CVE.

Environment (please complete the following information):

  • Quarkus version or git rev: 0.20 or the current master
@loicmathieu loicmathieu added the kind/bug Something isn't working label Aug 7, 2019
@loicmathieu
Copy link
Contributor Author

Update to undertown 2.0.23.Final or later is advised

@geoand geoand closed this as completed in d32ffe4 Aug 7, 2019
geoand added a commit that referenced this issue Aug 7, 2019
@geoand
Merge pull request #3447 from stuartwdouglas/3442
853bc23 
Fixes #3442 Undertow 2.0.23.Final
@gsmet gsmet added this to the 0.21.0 milestone Aug 13, 2019
Dufgui pushed a commit to Dufgui/quarkus that referenced this issue Aug 26, 2019
@stuartwdouglas @Dufgui
Fixes quarkusio#3442
28deea0 
Upgrade Undertow to 2.0.23.Final
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@stuartwdouglas stuartwdouglas

Labels
kind/bug Something isn't working
Projects
None yet
Milestone
0.21.0
Development

No branches or pull requests
3 participants
@stuartwdouglas @gsmet @loicmathieu