Bug 1803241 (CVE-2020-10705)

Summary:	CVE-2020-10705 undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aboyko, ahenning, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dhanak, dingyichen, dkreling, dosoudil, drosa, etirelli, extras-orphan, fjuma, ibek, istudens, ivassile, iweiss, jawilson, jbalunas, jochrist, jpallich, jperkins, jrokos, jstastny, jwon, krathod, kverlaen, kwills, lef, lgao, lthon, mnovotny, mosmerov, msochure, msvehla, mszynkie, nwallace, paradhya, pesilva, pgallagh, pjindal, pmackay, pskopek, psotirop, puntogil, rguimara, rrajasek, rruss, rstancel, rsvoboda, rsynek, sausingh, sdaley, security-response-team, sguilhen, smaestri, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Undertow 2.1.1.Final	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was discovered in Undertow where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-12 10:33:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1803243

Description Pedro Sampaio 2020-02-14 19:04:42 UTC

A flaw was found in Undertow. Certain requests to "Expect: 100-continue" header lead to out of memory issue potentially causing denial of service.

References:

https://issues.redhat.com/browse/UNDERTOW-1657

Comment 8 Chess Hazlett 2020-05-11 19:14:30 UTC

Mitigation:

There is currently no known mitigation for this security flaw.

Comment 9 errata-xmlrpc 2020-05-11 20:10:51 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:2058 https://access.redhat.com/errata/RHSA-2020:2058

Comment 10 errata-xmlrpc 2020-05-11 20:13:56 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:2059 https://access.redhat.com/errata/RHSA-2020:2059

Comment 11 errata-xmlrpc 2020-05-11 20:16:54 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:2060 https://access.redhat.com/errata/RHSA-2020:2060

Comment 12 errata-xmlrpc 2020-05-11 20:20:09 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:2061 https://access.redhat.com/errata/RHSA-2020:2061

Comment 13 Product Security DevOps Team 2020-05-12 10:33:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10705

Comment 16 errata-xmlrpc 2020-07-23 07:04:36 UTC

This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2905 https://access.redhat.com/errata/RHSA-2020:2905

Comment 17 errata-xmlrpc 2020-08-31 15:40:50 UTC

This issue has been addressed in the following products:

  EAP-CD 20 Tech Preview

Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585

Comment 22 errata-xmlrpc 2025-09-25 00:07:24 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Via RHSA-2025:16668 https://access.redhat.com/errata/RHSA-2025:16668