CVE-2019-10212
CVE-2019-10212
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
CVSS 4.8 · Medium · EPSS 1.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
undertow
- Versions
- all under 2.0.20: Affected
No fix published
undertow Debian:14
- Versions
- 1.3.11-1
- 1.3.16-1
- 1.3.19-1
- 1.3.21-1
- 1.3.23-1
- 1.3.4-1
- 1.3.5-1
- 1.3.7-1
- 1.4.0-1
- 1.4.1-1
- 1.4.18-1
- 1.4.20-1
- 1.4.21-1
- 1.4.21-2
- 1.4.22-1
- 1.4.23-1
- 1.4.23-2
- 1.4.23-3
- 1.4.25-1
- 1.4.25-2
- 1.4.3-1
- 1.4.4-1
- 1.4.6-1
- 1.4.7-1
- 1.4.8-1
- 2.0.23-1
- 2.0.25-1
- 2.0.26-1
- Affected ranges
- ECOSYSTEM: < 2.0.27-1
Update to 2.0.27-1
undertow Ubuntu:Pro:16.04:LTS
- Versions
- 1.3.4-1
- 1.3.5-1
- 1.3.7-1
- 1.3.11-1
- 1.3.16-1
- 1.3.16-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:Pro:18.04:LTS
- Versions
- 1.4.20-1
- 1.4.21-1
- 1.4.22-1
- 1.4.23-1
- 1.4.23-2build1
- 1.4.23-3
- 1.4.23-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:Pro:24.04:LTS
- Versions
- 2.3.8-2
- 2.3.8-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:25.10
- Versions
- 2.3.18-1
- 2.3.18-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:26.10
- Versions
- 2.3.20-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:26.04:LTS
- Versions
- 2.3.18-2
- 2.3.20-1
- 2.3.20-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published