CVE-2022-1259

moderate-risk

Published 2022-08-31

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (14)

Build Of Quarkus

Integration Camel K

Jboss Enterprise Application Platform

Openshift Application Runtimes

Single Sign-On

Undertow

Active Iq Unified Manager

Cloud Secure Agent

Oncommand Insight

Oncommand Workflow Automation

Affected Vendors

Redhat Netapp

References (6)

Vendor Advisory https://access.redhat.com/security/cve/CVE-2022-1259

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2072339

Third Party Advisory https://security.netapp.com/advisory/ntap-20221014-0006/

Vendor Advisory https://access.redhat.com/security/cve/CVE-2022-1259

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2072339

Third Party Advisory https://security.netapp.com/advisory/ntap-20221014-0006/

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 18/34 · Moderate