Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WFCORE-5946] Upgrade Undertow to 2.2.18.Final (fixes CVE-2022-1319) #5128

Closed
wants to merge 1 commit into from

Conversation

fl4via
Copy link
Contributor

@fl4via fl4via commented Jun 14, 2022

Jira: https://issues.redhat.com/browse/WFCORE-5946
Fixes CVE-2022-1319
Main PR: #5127

    Release Notes - Undertow - Version 2.2.18.Final

Sub-task

  • [UNDERTOW-1945] - ServletOutputStreamTestCase fails with Premature end of chunk coded message body

Bug

  • [UNDERTOW-2034] - Http2StreamSinkChannel.awaitWritable could throw "Out of control window" IOException before awaitWritable timeout has fully ellapsed
  • [UNDERTOW-2035] - Http2StreamSinkChannel overrides awaitWritable() but does not override awaitWritable(long, TimeUnit)
  • [UNDERTOW-2036] - AbstractFramedChannel.awaitWritable does not guard against spurious wakes
  • [UNDERTOW-2060] - CVE-2022-1319 Double AJP response for 400 from EAP 7 results in CPING failures
  • [UNDERTOW-2061] - IP address filter with netmask not working as expected
  • [UNDERTOW-2066] - AbstractFramedChannel.freeNotifier checks for receivesSuspendedByUser instead of receivesSuspendedTooManyBuffers
  • [UNDERTOW-2068] - AbstractFramedStreamSourceChannel read listener prevents read from running again
  • [UNDERTOW-2070] - Empty reply from Undertow if sendRedirect is called after setting content length
  • [UNDERTOW-2073] - JDK 8 / 11 updates breaking Undertow
  • [UNDERTOW-2079] - CPU spinning in AbstractFramedStreamSinkChannel
  • [UNDERTOW-2080] - Use currentTimeMillis instead of nanoTime to measure times in awaitWritable
  • [UNDERTOW-2094] - Bad relative redirect is generated if app is mapped to trailing slash context
  • [UNDERTOW-2102] - ServletPrintWriterDelegate throws exception using OpenJDK 19 EA

Component Upgrade

Enhancement

  • [UNDERTOW-2067] - AbstractFramedChannel should hold from resuming reads immediately after max buffer queue is hit

@fl4via fl4via changed the base branch from main to 18.x June 14, 2022 14:24
@fl4via fl4via changed the title Wfcore 5946 18.x [WFCORE-5946] Upgrade Undertow to 2.2.18.Final Jun 14, 2022
@fl4via fl4via changed the title [WFCORE-5946] Upgrade Undertow to 2.2.18.Final [WFCORE-5946] Upgrade Undertow to 2.2.18.Final (fixes CVE-2022-1319) Jun 14, 2022
@yersan yersan added the 18.x PRs meant for 18.x (corresponding to WildFly 26.x) label Jun 20, 2022
@github-actions
Copy link

github-actions bot commented Aug 5, 2022

There has been no activity on this PR for 45 days. It will be auto-closed after 90 days.

@github-actions github-actions bot added the Stale label Aug 5, 2022
@bstansberry
Copy link
Contributor

Superseded by #5170

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
18.x PRs meant for 18.x (corresponding to WildFly 26.x) Stale
Projects
None yet
3 participants