{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"High"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"undertow security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for undertow is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Java web server using non-blocking IO\n\nSecurity Fix(es):\n\nA vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)(CVE-2019-3888)\n\nA flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the \"Expect: 100-continue\" header may cause an out of memory error. This flaw may potentially lead to a denial of service.(CVE-2020-10705)\n\nA flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.(CVE-2020-10719)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for undertow is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"High",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"undertow",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2021-1422",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1422"
			},
			{
				"summary":"CVE-2019-3888",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2019-3888&packageName=undertow"
			},
			{
				"summary":"CVE-2020-10705",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2020-10705&packageName=undertow"
			},
			{
				"summary":"CVE-2020-10719",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2020-10719&packageName=undertow"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3888"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10705"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10719"
			},
			{
				"summary":"openEuler-SA-2021-1422 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2021/csaf-openeuler-sa-2021-1422.json"
			}
		],
		"title":"An update for undertow is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2",
		"tracking":{
			"initial_release_date":"2021-11-05T09:23:49+08:00",
			"revision_history":[
				{
					"date":"2021-11-05T09:23:49+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				},
				{
					"date":"2024-10-31T09:23:49+08:00",
					"summary":"final",
					"number":"2.0.0"
				}
			],
			"generator":{
				"date":"2024-10-31T09:23:49+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2024-10-31T09:23:49+08:00",
			"id":"openEuler-SA-2021-1422",
			"version":"2.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"openEuler-20.03-LTS-SP1",
									"name":"openEuler-20.03-LTS-SP1"
								},
								"name":"openEuler-20.03-LTS-SP1",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP2"
									},
									"product_id":"openEuler-20.03-LTS-SP2",
									"name":"openEuler-20.03-LTS-SP2"
								},
								"name":"openEuler-20.03-LTS-SP2",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"undertow-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP1)",
									"name":"undertow-1.4.0-4.oe1.noarch.rpm"
								},
								"name":"undertow-1.4.0-4.oe1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP1)",
									"name":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm"
								},
								"name":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP2"
									},
									"product_id":"undertow-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP2)",
									"name":"undertow-1.4.0-4.oe1.noarch.rpm"
								},
								"name":"undertow-1.4.0-4.oe1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP2"
									},
									"product_id":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP2)",
									"name":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm"
								},
								"name":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"undertow-1.4.0-4.oe1.src.rpm(20.03-LTS-SP1)",
									"name":"undertow-1.4.0-4.oe1.src.rpm"
								},
								"name":"undertow-1.4.0-4.oe1.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP2"
									},
									"product_id":"undertow-1.4.0-4.oe1.src.rpm(20.03-LTS-SP2)",
									"name":"undertow-1.4.0-4.oe1.src.rpm"
								},
								"name":"undertow-1.4.0-4.oe1.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"undertow-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
					"name":"undertow-1.4.0-4.oe1.noarch as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
					"name":"undertow-javadoc-1.4.0-4.oe1.noarch as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP2",
				"product_reference":"undertow-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP2)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
					"name":"undertow-1.4.0-4.oe1.noarch as a component of openEuler-20.03-LTS-SP2"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP2",
				"product_reference":"undertow-javadoc-1.4.0-4.oe1.noarch.rpm(20.03-LTS-SP2)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
					"name":"undertow-javadoc-1.4.0-4.oe1.noarch as a component of openEuler-20.03-LTS-SP2"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"undertow-1.4.0-4.oe1.src.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
					"name":"undertow-1.4.0-4.oe1.src as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP2",
				"product_reference":"undertow-1.4.0-4.oe1.src.rpm(20.03-LTS-SP2)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src",
					"name":"undertow-1.4.0-4.oe1.src as a component of openEuler-20.03-LTS-SP2"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2019-3888",
			"notes":[
				{
					"text":"A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
					"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
					],
					"details":"undertow security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1422"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.3,
						"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2019-3888"
		},
		{
			"cve":"CVE-2020-10705",
			"notes":[
				{
					"text":"A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the \"Expect: 100-continue\" header may cause an out of memory error. This flaw may potentially lead to a denial of service.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
					"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
					],
					"details":"undertow security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1422"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2020-10705"
		},
		{
			"cve":"CVE-2020-10719",
			"notes":[
				{
					"text":"A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
					"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
					"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
					],
					"details":"undertow security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1422"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":6.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP2:undertow-javadoc-1.4.0-4.oe1.noarch",
						"openEuler-20.03-LTS-SP1:undertow-1.4.0-4.oe1.src",
						"openEuler-20.03-LTS-SP2:undertow-1.4.0-4.oe1.src"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2020-10719"
		}
	]
}