CVE-2019-10184
CVE-2019-10184
This page contains facts from public vulnerability sources. Check the original advisory before updating.
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
CVSS 5.3 · Medium · EPSS 3.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
undertow
- Versions
- fixed in 2.0.23.Final: Affected
No fix published
undertow Debian:14
- Versions
- 1.3.11-1
- 1.3.16-1
- 1.3.19-1
- 1.3.21-1
- 1.3.23-1
- 1.3.4-1
- 1.3.5-1
- 1.3.7-1
- 1.4.0-1
- 1.4.1-1
- 1.4.18-1
- 1.4.20-1
- 1.4.21-1
- 1.4.21-2
- 1.4.22-1
- 1.4.23-1
- 1.4.23-2
- 1.4.23-3
- 1.4.25-1
- 1.4.25-2
- 1.4.3-1
- 1.4.4-1
- 1.4.6-1
- 1.4.7-1
- 1.4.8-1
- Affected ranges
- ECOSYSTEM: < 2.0.23-1
Update to 2.0.23-1
undertow Ubuntu:Pro:16.04:LTS
- Versions
- 1.3.4-1
- 1.3.5-1
- 1.3.7-1
- 1.3.11-1
- 1.3.16-1
- 1.3.16-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:Pro:18.04:LTS
- Versions
- 1.4.20-1
- 1.4.21-1
- 1.4.22-1
- 1.4.23-1
- 1.4.23-2build1
- 1.4.23-3
- 1.4.23-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:20.04:LTS
- Affected ranges
- ECOSYSTEM: < 2.0.23-1
Update to 2.0.23-1
undertow Ubuntu:Pro:24.04:LTS
- Versions
- 2.3.8-2
- 2.3.8-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:25.10
- Versions
- 2.3.18-1
- 2.3.18-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:26.10
- Versions
- 2.3.20-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:26.04:LTS
- Versions
- 2.3.18-2
- 2.3.20-1
- 2.3.20-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2019:2937
- https://access.redhat.com/errata/RHSA-2019:2935
- https://access.redhat.com/errata/RHSA-2019:2936
- https://access.redhat.com/errata/RHSA-2019:2938
- https://access.redhat.com/errata/RHSA-2019:2998
- https://access.redhat.com/errata/RHSA-2019:3044
- https://access.redhat.com/errata/RHSA-2019:3045
- https://access.redhat.com/errata/RHSA-2019:3050
- https://access.redhat.com/errata/RHSA-2019:3046
- https://access.redhat.com/errata/RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184
- https://github.com/undertow-io/undertow/pull/794
- https://security.netapp.com/advisory/ntap-20220210-0016/
- https://nvd.nist.gov/vuln/detail/CVE-2019-10184