What’s Vulnerable › Vulnerabilities

CVE-2022-1319

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-31 · updated 2026-06-17
• Weakness: CWE-252

Description

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

Affected products

• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Cloud Secure Agent: all versions
• OnCommand Insight: all versions
• NetApp OnCommand Workflow Automation: all versions
• RedHat Openshift Application Runtimes: all versions
• Red Hat Single Sign-On: 7.0
• Red Hat undertow: before 2.2.17; 2.2.17, 2.2.17-sp1, 2.2.17-sp2, 2.2.19, 2.2.19-sp1, 2.3.0-alpha1 — fixed in 2.2.17

How to fix

Upgrade to a fixed version: Red Hat undertow 2.2.17. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2022-1319
• https://bugzilla.redhat.com/show_bug.cgi?id=2073890
• https://github.com/undertow-io/undertow/commit/1443a1a2bbb8e32e56788109d8285db250d55c8b
• https://github.com/undertow-io/undertow/commit/7c5b3ab885b5638fd3f1e8a935d5063d68aa2df3
• https://issues.redhat.com/browse/UNDERTOW-2060
• https://security.netapp.com/advisory/ntap-20221014-0006/
• https://access.redhat.com/security/cve/CVE-2022-1319
• https://bugzilla.redhat.com/show_bug.cgi?id=2073890
• https://github.com/undertow-io/undertow/commit/1443a1a2bbb8e32e56788109d8285db250d55c8b
• https://github.com/undertow-io/undertow/commit/7c5b3ab885b5638fd3f1e8a935d5063d68aa2df3
• https://issues.redhat.com/browse/UNDERTOW-2060
• https://security.netapp.com/advisory/ntap-20221014-0006/

Get alerted when CVE-2022-1319 or the next vulnerability affects your stack