← Database

CVE-2022-4492

HIGH CVSS: 7.5 Published: 2023-02-23 Modified: 2026-06-17

Description

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

Affected Platforms

Redhat Migration Toolkit For ApplicationsRedhat UndertowRedhat Jboss FuseRedhat Integration Camel For Spring BootRedhat Single Sign-OnRedhat Integration Camel KRedhat Integration Service RegistryRedhat Migration Toolkit For RuntimesRedhat Build Of QuarkusRedhat Jboss Enterprise Application Platform

Weakness Type

NVD-CWE-noinfo, CWE-918

References