CVE-2022-4492

Published: Feb 23, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

Affected (10)

Products: Redhat: Build Of Quarkus, Integration Camel For Spring Boot, Integration Camel K, Integration Service Registry, Jboss Enterprise Application Platform, Jboss Fuse, Migration Toolkit For Applications, Migration Toolkit For Runtimes, Single Sign On, Undertow

Redhat

10 products

Build Of Quarkus

Integration Camel For Spring Boot

Integration Camel K

Integration Service Registry

Jboss Enterprise Application Platform

Jboss Fuse

Migration Toolkit For Applications

Migration Toolkit For Runtimes

Single Sign On

Undertow

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Redhat Build Of Quarkus	All versions
Redhat Integration Camel For Spring Boot	All versions
Redhat Integration Camel K	All versions
Redhat Integration Service Registry	All versions
Redhat Jboss Enterprise Application Platform	Version 7.0.0
Redhat Jboss Fuse	Version 7.0.0
Redhat Migration Toolkit For Applications	Version 6.0
Redhat Migration Toolkit For Runtimes	All versions
Redhat Single Sign On	Version 7.0
Redhat Undertow	Version 2.7.0