[GHSA-pfcc-3g6r-8rg8] Undertow client not checking server identity presented by server certificate in https connections

[fawind]

Updates

• Affected products
• References

Comments
GHSA-pfcc-3g6r-8rg8 (CVE-2022-4492)

Updating patched versions:

• 2.3.5.Final contains the patch for 2.3.x versions.
• 2.2.24.Final contains the back-ported patch for 2.2.x versions.

Relevant Links

• Undertow tracking issue listing the fixed versions: https://issues.redhat.com/browse/UNDERTOW-2212
• PR with the fix for 2.3.x: [UNDERTOW-2212] CVE-2022-4492 Server identity in https connection is … undertow-io/undertow#1447
• PR with the backport to 2.2.x: [UNDERTOW-2207][UNDERTOW-2212][UNDERTOW-2239][UNDERTOW-2252] 2.2.x backport bug fixes undertow-io/undertow#1457

[advisory-database]

Hi @fawind! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!