CVE-2022-1319

Published: Aug 31, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

Affected (15)

Products: Redhat: Openshift Application Runtimes, Single Sign On, Undertow · Netapp: Active Iq Unified Manager, Cloud Secure Agent, Oncommand Insight, Oncommand Workflow Automation

Redhat

3 products

Openshift Application Runtimes

Single Sign On

Undertow

Netapp

4 products

Active Iq Unified Manager

Cloud Secure Agent

Oncommand Insight

Oncommand Workflow Automation

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Application Runtimes	All versions
Redhat Single Sign On	Version 7.0
Redhat Undertow	Before 2.2.17
Redhat Undertow	Version 2.2.17
Redhat Undertow	Version 2.2.17 sp1
Redhat Undertow	Version 2.2.17 sp2
Redhat Undertow	Version 2.2.19
Redhat Undertow	Version 2.2.19 sp1
Redhat Undertow	Version 2.3.0 alpha1

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Cloud Secure Agent	All versions
Netapp Oncommand Insight	All versions
Netapp Oncommand Workflow Automation	All versions