Read the docs
TI-2019-07532 Aliases CVE-2019-10212GHSA-8vh8-vc28-m2hf

Sensitive information in log files in Red Hat undertow

Priority MEDIUM 46CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 7 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

Why it matters now

EPSS 0.01892 79th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.0.20Red Hat: 7 advisoriesRed Hat: 7 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatundertowall under 2.0.20—No fix listedCNA
—io.undertow:undertow-core (Maven)before 2.0.202.0.20Patch availableGHSA-8vh8-vc28-m2hf
  • undertow VendorRed Hat Affected all under 2.0.20 Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.0.20 Fixed in 2.0.20 Patch available GHSA-8vh8-vc28-m2hf

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.0.20VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:*:*:*:*:*:*:*:*7.0.0 – 7.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*7.0.0 – 7.4VulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*7.0 – 7.3VulnerableRed Hat
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.0.20 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:* Versions 7.0 – 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat

Remediation

  • Fix · GHSA-8vh8-vc28-m2hf io.undertow:undertow-core (Maven) Fixed in 2.0.20 Advisory →

Red Hat 7 advisories

  • RHSA-2020:0727 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.3 security update
    • Red Hat Data Grid 7.3.3
  • RHSA-2019:3050 Released 2019-10-14 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.4 security update
    • Red Hat Single Sign-On 7.3.4 zip
  • RHSA-2019:2998 Released 2019-10-10 · Red Hat rating Important
    Red Hat OpenShift Application Runtimes Thorntail 2.5.0 security & bug fix update
    • Text-Only RHOAR
Show 4 more Red Hat advisories
  • RHSA-2019:2936 Released 2019-10-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el7eap +47
  • RHSA-2019:2937 Released 2019-10-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el8eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el8eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el8eap +47
  • RHSA-2019:2935 Released 2019-10-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 6 Security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el6eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el6eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el6eap +47
  • RHSA-2019:2938 Released 2019-09-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.4 security update
    • Red Hat JBoss EAP 7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat Data Grid 7.3.3Fixed RHSA-2020:0727
Red Hat JBoss EAP 7.2Fixed RHSA-2019:2938
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2019:2935
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2019:2936
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2019:2937
Red Hat Single Sign-On 7.3.4 zipFixed RHSA-2019:3050
Text-Only RHOARFixed RHSA-2019:2998
Not affected: 1 product
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10212
  2. 2026-10-03 Alias added: GHSA-8vh8-vc28-m2hf

References

Advisory 5

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2022-01156 Improper input validation in gzip, xz-utils CVSS 3.1HIGH 8.8
  • TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
  • TI-2019-07479 Session fixation in Red Hat infinispan CVSS 3.1CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences