CVE-2024-7885 - Vulnerability Details - OpenCVE

Description

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.

Published: 2024-08-21

Score: 7.5 High

EPSS: 2.6% Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

unaffected

Version	Status	Constraints
`0`	affected	< 2.2.36.Final
`2.3.0.Alpha1`	affected	< 2.3.17.Final

Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4 unaffected —

Red Hat Red Hat build of Apache Camel 3.20.7 for Spring Boot unaffected —

Red Hat Red Hat build of Apache Camel 4.4.2 for Spring Boot unaffected —

Red Hat

Red Hat JBoss Enterprise Application Platform

affected

Version	Status	Constraints
`2.2.33.SP2-redhat-00001`	unaffected	< *

Red Hat Red Hat JBoss Enterprise Application Platform 7 unaffected —

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:1.11.0-1.redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.4.11-1.Final_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:1.7.2-19.Final_redhat_00020.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.0.41-5.SP6_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:7.3.15-5.GA_redhat_00003.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-4.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-4.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-6.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-4.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-6.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.10.4-3.redhat_00008.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:1.7.2-20.Final_redhat_00021.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:4.1.63-6.Final_redhat_00004.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:2.0.41-6.SP7_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

affected

Version	Status	Constraints
`0:7.3.16-3.GA_redhat_00003.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

affected

Version	Status	Constraints
`0:2.2.33-2.SP2_redhat_00001.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

affected

Version	Status	Constraints
`0:7.4.18-1.GA_redhat_00003.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

affected

Version	Status	Constraints
`0:2.2.33-2.SP2_redhat_00001.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

affected

Version	Status	Constraints
`0:7.4.18-1.GA_redhat_00003.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

affected

Version	Status	Constraints
`0:2.2.33-2.SP2_redhat_00001.1.el7eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

affected

Version	Status	Constraints
`0:7.4.18-1.GA_redhat_00003.1.el7eap`	unaffected	< *

Red Hat Red Hat JBoss Enterprise Application Platform 8 unaffected —

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:1.11.9-2.redhat_00001.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:800.3.1-2.GA_redhat_00002.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:2.3.14-2.SP2_redhat_00001.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

affected

Version	Status	Constraints
`0:8.0.3-13.GA_redhat_00007.1.el8eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:1.11.9-2.redhat_00001.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:800.3.1-2.GA_redhat_00002.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:2.3.14-2.SP2_redhat_00001.1.el9eap`	unaffected	< *

Red Hat

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

affected

Version	Status	Constraints
`0:8.0.3-13.GA_redhat_00007.1.el9eap`	unaffected	< *

Red Hat Red Hat build of Apache Camel for Spring Boot 3 affected —

Red Hat Red Hat build of Apache Camel - HawtIO 4 affected —

Red Hat Red Hat Build of Keycloak affected —

Red Hat Red Hat build of Quarkus unaffected —

Red Hat Red Hat Data Grid 8 affected —

Red Hat Red Hat Fuse 7 affected —

Red Hat Red Hat Integration Camel K 1 affected —

Red Hat Red Hat JBoss Data Grid 7 unknown —

Red Hat Red Hat JBoss Enterprise Application Platform 7 unaffected —

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack unaffected —

Red Hat Red Hat Process Automation 7 unknown —

Red Hat Red Hat Single Sign-On 7 affected —

Configuration 1 [-]

OR	cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:::::::*
	cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:::::::*
	cpe:2.3:a:redhat:build_of_keycloak:-:::::::*
	cpe:2.3:a:redhat:data_grid:8.0.0:::::::*
	cpe:2.3:a:redhat:integration_camel_k:-:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:::::::*
	cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:::::::*
	cpe:2.3:a:redhat:jboss_fuse:7.0.0:::::::*
	cpe:2.3:a:redhat:process_automation:7.0:::::::*
	cpe:2.3:a:redhat:single_sign-on:7.0:::::::*

Package	CPE	Advisory	Released Date
HawtIO 4.0.0 for Red Hat build of Apache Camel 4
undertow	cpe:/a:redhat:rhboac_hawtio:4.0.0	RHSA-2024:11023	2024-12-12T00:00:00Z
Red Hat build of Apache Camel 3.20.7 for Spring Boot
undertow	cpe:/a:redhat:apache_camel_spring_boot:3.20.7	RHSA-2024:6883	2024-09-19T00:00:00Z
Red Hat build of Apache Camel 4.4.2 for Spring Boot
undertow	cpe:/a:redhat:apache_camel_spring_boot:4.4.2	RHSA-2024:6508	2024-09-09T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7
	cpe:/a:redhat:jboss_enterprise_application_platform:7.4	RHSA-2024:7735	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8	RHSA-2024:7736	2024-10-07T00:00:00Z
eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8	RHSA-2024:7736	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9	RHSA-2024:7736	2024-10-07T00:00:00Z
eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9	RHSA-2024:7736	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el7eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7	RHSA-2024:7736	2024-10-07T00:00:00Z
eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el7eap	cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7	RHSA-2024:7736	2024-10-07T00:00:00Z
Red Hat JBoss Enterprise Application Platform 8
undertow-core	cpe:/a:redhat:jboss_enterprise_application_platform:8.0	RHSA-2024:7442	2024-10-01T00:00:00Z
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el8eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8	RHSA-2024:7441	2024-10-01T00:00:00Z
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z
eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el9eap	cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9	RHSA-2024:7441	2024-10-01T00:00:00Z

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-9623-mqmm-5rcf	Undertow vulnerable to Race Condition

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.02644.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2024:11023
https://access.redhat.com/errata/RHSA-2024:6508
https://access.redhat.com/errata/RHSA-2024:6883
https://access.redhat.com/errata/RHSA-2024:7441
https://access.redhat.com/errata/RHSA-2024:7442
https://access.redhat.com/errata/RHSA-2024:7735
https://access.redhat.com/errata/RHSA-2024:7736
https://access.redhat.com/errata/RHSA-2024:8080
https://access.redhat.com/errata/RHSA-2025:16667
https://access.redhat.com/errata/RHSA-2026:0743
https://access.redhat.com/security/cve/CVE-2024-7885
https://bugzilla.redhat.com/show_bug.cgi?id=2305290
https://nvd.nist.gov/vuln/detail/CVE-2024-7885
https://security.netapp.com/advisory/ntap-20241011-0004/
https://www.cve.org/CVERecord?id=CVE-2024-7885

History

Thu, 08 Oct 2026 13:15:00 +0200

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:rhboac_hawtio:4.0

Fri, 07 Aug 2026 12:15:00 +0200

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:jboss_enterprise_application_platform:7

Mon, 19 Jan 2026 05:00:00 +0100

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:0743

Fri, 24 Oct 2025 00:45:00 +0200

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2024:8080

Thu, 25 Sep 2025 09:30:00 +0200

Type	Values Removed	Values Added
First Time appeared		Redhat jboss Enterprise Application Platform Eus
CPEs		cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7
Vendors & Products		Redhat jboss Enterprise Application Platform Eus
References		https://access.redhat.com/errata/RHSA-2025:16667

Wed, 16 Jul 2025 15:45:00 +0200

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.28035}`	epss `{'score': 0.24383}`

Wed, 18 Jun 2025 20:15:00 +0200

Type	Values Removed	Values Added
First Time appeared		Redhat apache Camel Hawtio
CPEs		cpe:/a:redhat:apache_camel_hawtio:4
Vendors & Products		Redhat apache Camel Hawtio

Thu, 12 Dec 2024 23:00:00 +0100

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:rhboac_hawtio:4~~	cpe:/a:redhat:rhboac_hawtio:4.0.0
References		https://access.redhat.com/errata/RHSA-2024:11023

Fri, 22 Nov 2024 13:00:00 +0100

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20241011-0004/

Mon, 07 Oct 2024 23:15:00 +0200

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:jboss_enterprise_application_platform:7~~	cpe:/a:redhat:jboss_enterprise_application_platform:7.4 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
References		https://access.redhat.com/errata/RHSA-2024:7735 https://access.redhat.com/errata/RHSA-2024:7736

Tue, 01 Oct 2024 13:15:00 +0200

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:jboss_enterprise_application_platform:8~~	cpe:/a:redhat:jboss_enterprise_application_platform:8.0 cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
References		https://access.redhat.com/errata/RHSA-2024:7441 https://access.redhat.com/errata/RHSA-2024:7442

Thu, 19 Sep 2024 22:00:00 +0200

Type	Values Removed	Values Added
CPEs		cpe:/a:redhat:apache_camel_spring_boot:3.20.7
References		https://access.redhat.com/errata/RHSA-2024:6883

Wed, 18 Sep 2024 09:45:00 +0200

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:build_keycloak:22~~	cpe:/a:redhat:build_keycloak:

Tue, 10 Sep 2024 00:45:00 +0200

Type	Values Removed	Values Added
First Time appeared		Redhat apache Camel Spring Boot
CPEs	~~cpe:/a:redhat:camel_spring_boot:4~~	cpe:/a:redhat:apache_camel_spring_boot:4.4.2 cpe:/a:redhat:camel_spring_boot:3
Vendors & Products		Redhat apache Camel Spring Boot
References		https://access.redhat.com/errata/RHSA-2024:6508

Fri, 23 Aug 2024 19:30:00 +0200

Type	Values Removed	Values Added
First Time appeared		Redhat build Of Apache Camel - Hawtio Redhat build Of Apache Camel For Spring Boot Redhat build Of Keycloak Redhat data Grid Redhat integration Camel K Redhat process Automation Redhat single Sign-on
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:::::::* cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:::::::* cpe:2.3:a:redhat:build_of_keycloak:-:::::::* cpe:2.3:a:redhat:data_grid:8.0.0:::::::* cpe:2.3:a:redhat:integration_camel_k:-:::::::* cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:::::::* cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:::::::* cpe:2.3:a:redhat:jboss_fuse:7.0.0:::::::* cpe:2.3:a:redhat:process_automation:7.0:::::::* cpe:2.3:a:redhat:single_sign-on:7.0:::::::*
Vendors & Products		Redhat build Of Apache Camel - Hawtio Redhat build Of Apache Camel For Spring Boot Redhat build Of Keycloak Redhat data Grid Redhat integration Camel K Redhat process Automation Redhat single Sign-on

Wed, 21 Aug 2024 18:30:00 +0200

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 21 Aug 2024 16:15:00 +0200

Type	Values Removed	Values Added
Description	No description is available for this CVE.	A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
Title	undertow: Improper State Management in Proxy Protocol parsing causes information leakage	Undertow: improper state management in proxy protocol parsing causes information leakage
First Time appeared		Redhat Redhat build Keycloak Redhat camel Spring Boot Redhat integration Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Enterprise Bpms Platform Redhat jboss Fuse Redhat jbosseapxp Redhat quarkus Redhat red Hat Single Sign On Redhat rhboac Hawtio
CPEs		cpe:/a:redhat:build_keycloak:22 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:integration:1 cpe:/a:redhat:jboss_data_grid:7 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_bpms_platform:7 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:jbosseapxp cpe:/a:redhat:quarkus:3 cpe:/a:redhat:red_hat_single_sign_on:7 cpe:/a:redhat:rhboac_hawtio:4
Vendors & Products		Redhat Redhat build Keycloak Redhat camel Spring Boot Redhat integration Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Enterprise Bpms Platform Redhat jboss Fuse Redhat jbosseapxp Redhat quarkus Redhat red Hat Single Sign On Redhat rhboac Hawtio
References		https://access.redhat.com/security/cve/CVE-2024-7885 https://bugzilla.redhat.com/show_bug.cgi?id=2305290

Sat, 17 Aug 2024 01:15:00 +0200

Type	Values Removed	Values Added
Description		No description is available for this CVE.
Title		undertow: Improper State Management in Proxy Protocol parsing causes information leakage
Weaknesses		CWE-362
References		https://nvd.nist.gov/vuln/detail/CVE-2024-7885 https://www.cve.org/CVERecord?id=CVE-2024-7885
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Subscriptions

Redhat Apache Camel Hawtio Apache Camel Spring Boot Build Keycloak Build Of Apache Camel - Hawtio Build Of Apache Camel For Spring Boot Build Of Keycloak Camel Spring Boot Data Grid Integration Integration Camel K Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus Jboss Enterprise Bpms Platform Jboss Fuse Jbosseapxp Process Automation Quarkus Red Hat Single Sign On Rhboac Hawtio Single Sign-on

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2024-08-21T14:13:36.579Z

Updated: 2026-10-08T10:55:13.743Z

Reserved: 2024-08-16T15:35:47.357Z

Link: CVE-2024-7885

Vulnrichment

Updated: 2024-10-11T22:03:18.905Z

NVD

Status : Modified

Published: 2024-08-21T14:15:09.500

Modified: 2026-10-08T11:16:41.713

Link: CVE-2024-7885

Redhat

Severity : Important

Publid Date: 2024-08-07T00:00:00Z

Links: CVE-2024-7885 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
NVD-CWE-noinfo

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-7885", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-08-16T15:35:47.357Z", "datePublished": "2024-08-21T14:13:36.579Z", "dateUpdated": "2026-10-08T10:55:13.743Z"}, "containers": {"cna": {"title": "Undertow: improper state management in proxy protocol parsing causes information leakage", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.2.36.Final", "versionType": "custom"}, {"status": "affected", "version": "2.3.0.Alpha1", "lessThan": "2.3.17.Final", "versionType": "custom"}], "packageName": "undertow", "collectionURL": "https://github.com/undertow-io/undertow", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow", "cpes": ["cpe:/a:redhat:rhboac_hawtio:4.0"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:3.20.7"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.4.2"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "io.undertow/undertow-core", "defaultStatus": "affected", "versions": [{"version": "2.2.33.SP2-redhat-00001", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-apache-commons-beanutils", "defaultStatus": "affected", "versions": [{"version": "0:1.11.0-1.redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-hornetq", "defaultStatus": "affected", "versions": [{"version": "0:2.4.11-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jboss-server-migration", "defaultStatus": "affected", "versions": [{"version": "0:1.7.2-19.Final_redhat_00020.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.0.41-5.SP6_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.3.15-5.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-annotations", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-core", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-databind", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-jaxrs-providers", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-modules-base", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jackson-modules-java8", "defaultStatus": "affected", "versions": [{"version": "0:2.10.4-3.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-jboss-server-migration", "defaultStatus": "affected", "versions": [{"version": "0:1.7.2-20.Final_redhat_00021.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-netty", "defaultStatus": "affected", "versions": [{"version": "0:4.1.63-6.Final_redhat_00004.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.0.41-6.SP7_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.3.16-3.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.2.33-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.4.18-1.GA_redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.2.33-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.4.18-1.GA_redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.2.33-2.SP2_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap7-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:7.4.18-1.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "undertow-core", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-amazon-ion-java", "defaultStatus": "affected", "versions": [{"version": "0:1.11.9-2.redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-eap-product-conf-parent", "defaultStatus": "affected", "versions": [{"version": "0:800.3.1-2.GA_redhat_00002.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.3.14-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:8.0.3-13.GA_redhat_00007.1.el8eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-amazon-ion-java", "defaultStatus": "affected", "versions": [{"version": "0:1.11.9-2.redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-eap-product-conf-parent", "defaultStatus": "affected", "versions": [{"version": "0:800.3.1-2.GA_redhat_00002.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-undertow", "defaultStatus": "affected", "versions": [{"version": "0:2.3.14-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "eap8-wildfly", "defaultStatus": "affected", "versions": [{"version": "0:8.0.3-13.GA_redhat_00007.1.el9eap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel for Spring Boot 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_spring_boot:3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}, {"vendor": "Red Hat", "product": "Red Hat build of Quarkus", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "quarkus-undertow", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat Data Grid 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"]}, {"vendor": "Red Hat", "product": "Red Hat Fuse 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_fuse:7"]}, {"vendor": "Red Hat", "product": "Red Hat Integration Camel K 1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:integration:1"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Data Grid 7", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:jboss_data_grid:7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow-core", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "undertow-core", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat Process Automation 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"]}, {"vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "undertow", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:11023", "name": "RHSA-2024:11023", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6508", "name": "RHSA-2024:6508", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6883", "name": "RHSA-2024:6883", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7441", "name": "RHSA-2024:7441", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7442", "name": "RHSA-2024:7442", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7735", "name": "RHSA-2024:7735", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7736", "name": "RHSA-2024:7736", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:8080", "name": "RHSA-2024:8080", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:16667", "name": "RHSA-2025:16667", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0743", "name": "RHSA-2026:0743", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-7885", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290", "name": "RHBZ#2305290", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-08-07T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "timeline": [{"lang": "en", "time": "2024-08-16T09:00:41.686Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-08-07T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank BfC for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-08T10:55:13.743Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-21T15:21:22.416004Z", "id": "CVE-2024-7885", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T15:21:42.735Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241011-0004/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-10-11T22:03:18.905Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20241011-0004/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-10-11T22:03:18.905Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-7885", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-21T15:21:22.416004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T15:21:28.865Z"}}], "cna": {"title": "Undertow: improper state management in proxy protocol parsing causes information leakage", "credits": [{"lang": "en", "value": "Red Hat would like to thank BfC for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.2.36.Final", "versionType": "custom"}, {"status": "affected", "version": "2.3.0.Alpha1", "lessThan": "2.3.17.Final", "versionType": "custom"}], "packageName": "undertow", "collectionURL": "https://github.com/undertow-io/undertow", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:rhboac_hawtio:4.0.0"], "vendor": "Red Hat", "product": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:3.20.7"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.4.2"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform", "versions": [{"status": "unaffected", "version": "2.2.33.SP2-redhat-00001", "lessThan": "*", "versionType": "rpm"}], "packageName": "io.undertow/undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.11.0-1.redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-apache-commons-beanutils", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.4.11-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-hornetq", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.7.2-19.Final_redhat_00020.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.0.41-5.SP6_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.3.15-5.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.10.4-3.redhat_00008.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.7.2-20.Final_redhat_00021.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.63-6.Final_redhat_00004.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.0.41-6.SP7_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.3.16-3.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-amazon-ion-java", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-amazon-ion-java", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:camel_spring_boot:3"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel for Spring Boot 3", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:quarkus:3"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus", "packageName": "quarkus-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "vendor": "Red Hat", "product": "Red Hat Data Grid 8", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:integration:1"], "vendor": "Red Hat", "product": "Red Hat Integration Camel K 1", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:7"], "vendor": "Red Hat", "product": "Red Hat JBoss Data Grid 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "undertow-core", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"], "vendor": "Red Hat", "product": "Red Hat Process Automation 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "packageName": "undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2024-08-16T09:00:41.686Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-08-07T00:00:00.000Z", "value": "Made public."}], "datePublic": "2024-08-07T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:11023", "name": "RHSA-2024:11023", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6508", "name": "RHSA-2024:6508", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:6883", "name": "RHSA-2024:6883", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7441", "name": "RHSA-2024:7441", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7442", "name": "RHSA-2024:7442", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7735", "name": "RHSA-2024:7735", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:7736", "name": "RHSA-2024:7736", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:8080", "name": "RHSA-2024:8080", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:16667", "name": "RHSA-2025:16667", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0743", "name": "RHSA-2026:0743", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-7885", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290", "name": "RHBZ#2305290", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-24T03:04:26.735Z"}, "x_redhatCweChain": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}}, "cveMetadata": {"cveId": "CVE-2024-7885", "state": "PUBLISHED", "dateUpdated": "2026-09-24T03:04:26.735Z", "dateReserved": "2024-08-16T15:35:47.357Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-08-21T14:13:36.579Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/undertow-io/undertow", "defaultStatus": "unaffected", "packageName": "undertow", "versions": [{"lessThan": "2.2.36.Final", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "2.3.17.Final", "status": "affected", "version": "2.3.0.Alpha1", "versionType": "custom"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhboac_hawtio:4.0"], "defaultStatus": "unaffected", "packageName": "undertow", "product": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:3.20.7"], "defaultStatus": "unaffected", "packageName": "undertow", "product": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.4.2"], "defaultStatus": "unaffected", "packageName": "undertow", "product": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "defaultStatus": "affected", "packageName": "io.undertow/undertow-core", "product": "Red Hat JBoss Enterprise Application Platform", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.2.33.SP2-redhat-00001", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"], "defaultStatus": "unaffected", "product": "Red Hat JBoss Enterprise Application Platform 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-apache-commons-beanutils", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.11.0-1.redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-hornetq", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.4.11-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.7.2-19.Final_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.41-5.SP6_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.3.15-5.GA_redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-4.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-6.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.10.4-3.redhat_00008.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.7.2-20.Final_redhat_00021.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.63-6.Final_redhat_00004.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.0.41-6.SP7_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.3.16-3.GA_redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.33-2.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.18-1.GA_redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-amazon-ion-java", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-undertow", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-amazon-ion-java", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.11.9-2.redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:800.3.1-2.GA_redhat_00002.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-undertow", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-2.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.0.3-13.GA_redhat_00007.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_spring_boot:3"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat build of Apache Camel for Spring Boot 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quarkus:3"], "defaultStatus": "unaffected", "packageName": "quarkus-undertow", "product": "Red Hat build of Quarkus", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Data Grid 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:integration:1"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Integration Camel K 1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_data_grid:7"], "defaultStatus": "unknown", "packageName": "undertow", "product": "Red Hat JBoss Data Grid 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:7"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "unaffected", "packageName": "undertow-core", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"], "defaultStatus": "unknown", "packageName": "undertow", "product": "Red Hat Process Automation 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "affected", "packageName": "undertow", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:*:*:*:*:*:*:*", "matchCriteriaId": "4B1DC0F4-BF84-4399-9487-DEF10CEC3D97", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:*:*:*:*:*:*:*", "matchCriteriaId": "EDE67672-8894-448B-84B5-3CD3610A8117", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:*:*:*:*", "matchCriteriaId": "824BB506-D01A-4C88-AD4A-3C94A2409CD2", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3311F2A9-C028-4765-BF79-BC370D15550C", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*", "matchCriteriaId": "B87C8AD3-8878-4546-86C2-BF411876648C", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "72A54BDA-311C-413B-8E4D-388AD65A170A", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "0D8BC03A-4198-4488-946B-3F6B43962942", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B40CCE4F-EA2C-453D-BB76-6388767E5C6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "20A6B40D-F991-4712-8E30-5FE008505CB7", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Undertow donde ProxyProtocolReadListener reutiliza la misma instancia de StringBuilder en m\u00faltiples solicitudes. Este problema ocurre cuando el m\u00e9todo parseProxyProtocolV1 procesa m\u00faltiples solicitudes en la misma conexi\u00f3n HTTP. Como resultado, diferentes solicitudes pueden compartir la misma instancia de StringBuilder, lo que podr\u00eda provocar una fuga de informaci\u00f3n entre solicitudes o respuestas. En algunos casos, un valor de una solicitud o respuesta anterior puede reutilizarse por error, lo que podr\u00eda provocar una exposici\u00f3n no deseada de los datos. Este problema produce principalmente errores y terminaci\u00f3n de la conexi\u00f3n, pero crea un riesgo de fuga de datos en entornos de solicitudes m\u00faltiples."}], "id": "CVE-2024-7885", "lastModified": "2026-10-08T11:16:41.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-7885", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-21T15:21:22.416004Z", "version": "2.0.3"}}]}, "published": "2024-08-21T14:15:09.500", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:11023"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:6508"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:6883"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7441"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7442"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7735"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:7736"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:8080"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2025:16667"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:0743"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2024-7885"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241011-0004/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank BfC for reporting this issue.", "affected_release": [{"advisory": "RHSA-2024:11023", "cpe": "cpe:/a:redhat:rhboac_hawtio:4.0.0", "package": "undertow", "product_name": "HawtIO 4.0.0 for Red Hat build of Apache Camel 4", "release_date": "2024-12-12T00:00:00Z"}, {"advisory": "RHSA-2024:6883", "cpe": "cpe:/a:redhat:apache_camel_spring_boot:3.20.7", "package": "undertow", "product_name": "Red Hat build of Apache Camel 3.20.7 for Spring Boot", "release_date": "2024-09-19T00:00:00Z"}, {"advisory": "RHSA-2024:6508", "cpe": "cpe:/a:redhat:apache_camel_spring_boot:4.4.2", "package": "undertow", "product_name": "Red Hat build of Apache Camel 4.4.2 for Spring Boot", "release_date": "2024-09-09T00:00:00Z"}, {"advisory": "RHSA-2024:7735", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4", "product_name": "Red Hat JBoss Enterprise Application Platform 7", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "package": "eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8", "package": "eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9", "package": "eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9", "package": "eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "package": "eap7-undertow-0:2.2.33-2.SP2_redhat_00001.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7736", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7", "package": "eap7-wildfly-0:7.4.18-1.GA_redhat_00003.1.el7eap", "product_name": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7", "release_date": "2024-10-07T00:00:00Z"}, {"advisory": "RHSA-2024:7442", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0", "package": "undertow-core", "product_name": "Red Hat JBoss Enterprise Application Platform 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8", "package": "eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el8eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-amazon-ion-java-0:1.11.9-2.redhat_00001.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-eap-product-conf-parent-0:800.3.1-2.GA_redhat_00002.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-undertow-0:2.3.14-2.SP2_redhat_00001.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}, {"advisory": "RHSA-2024:7441", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9", "package": "eap8-wildfly-0:8.0.3-13.GA_redhat_00007.1.el9eap", "product_name": "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9", "release_date": "2024-10-01T00:00:00Z"}], "bugzilla": {"description": "undertow: Improper State Management in Proxy Protocol parsing causes information leakage", "id": "2305290", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305290"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-362", "details": ["A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.", "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments."], "name": "CVE-2024-7885", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:3", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat build of Apache Camel for Spring Boot 3"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "io.quarkus/quarkus-undertow", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Will not fix", "package_name": "undertow", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Will not fix", "package_name": "undertow", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Will not fix", "package_name": "undertow", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Out of support scope", "package_name": "undertow", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "undertow-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Out of support scope", "package_name": "undertow", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Affected", "package_name": "undertow", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2024-08-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-7885\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-7885"], "statement": "Red Hat decided to rate this vulnerability as Important because of the potential loss of Availability and no additional privileges being required.", "threat_severity": "Important"}