Information Leak Vulnerability in Undertow: CVE-2018-14642
Summary
CVE-2018-14642: An information leak vulnerability was found in Undertow. Affects undertow versions < 2.0.23-1. Fixed in 2.0.23-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a flexible and performant web server written in Java, designed to handle both blocking and non-blocking APIs. It is widely used in various applications for its lightweight nature and ability to serve both static and dynamic content. However, it is susceptible to an information leak vulnerability that can expose sensitive data from previous requests.
Vulnerability Detail
CVE-2018-14642 is an information leak vulnerability found in Undertow. The issue arises when not all headers are written out in the first write() call. Consequently, the code responsible for flushing the buffer may inadvertently write out the entire contents of the writevBuffer buffer, which could include sensitive data from previous requests. This vulnerability can lead to unauthorized access to potentially sensitive information, posing a significant risk to applications relying on Undertow.
How To Fix
Minimum fixed version
2.0.23-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade undertowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that all headers are written out in the first write() call to prevent the flushing mechanism from exposing previous request data. This may involve reviewing and modifying the code where the write() function is called to ensure proper header management.
Conclusion
CVE-2018-14642 is a significant vulnerability in the Undertow web server that can lead to information leaks. It is crucial for users to update to the patched version to mitigate risks. Additionally, implementing the suggested workaround can provide temporary relief until an update is feasible.
See every vulnerability recorded for undertow →
FAQ
CVE-2018-14642 is an information leak vulnerability in the Undertow web server that can expose sensitive data from previous requests.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The CVSS score for CVE-2018-14642 is 5.3, indicating a moderate severity level.
If an immediate update is not possible, implement the recommended workaround by ensuring all headers are written out in the first write() call.
More information about Undertow can be found on its official documentation page, which provides insights into its features and usage.
Related vulnerabilities
Recent vulnerabilities recorded for undertow.
