{"action":"Upgrade io.undertow:undertow-core to 2.2.24.Final (2.2.x) or 2.3.5.Final (2.3.x) or later.","affected":[{"fixed":"2.3.5.Final","introduced":"2.3.0"},{"fixed":"2.2.24.Final","introduced":"0"}],"component":"io.undertow:undertow-core","cve_ids":["CVE-2022-4492"],"ecosystem":"Maven","epss":0.00596,"exploited":false,"fixed_versions":["2.3.5.Final","2.2.24.Final"],"ghsa_id":"GHSA-pfcc-3g6r-8rg8","id":"tcs_01M5N97A0WG5JDRNQ1K6EZ7EW5","modified_at":"2025-03-12T22:11:00.079748Z","published_at":"2023-02-23T21:30:16Z","references":["https://osv.dev/vulnerability/GHSA-pfcc-3g6r-8rg8","https://nvd.nist.gov/vuln/detail/CVE-2022-4492","https://github.com/undertow-io/undertow/pull/1447","https://github.com/undertow-io/undertow/pull/1447/commits/e5071e52b72529a14d3ec436ae7102cea5d918c4","https://github.com/undertow-io/undertow/pull/1457","https://github.com/undertow-io/undertow/pull/1457/commits/a4d3b167126a803cc4f7fb740dd9a6ecabf59342","https://access.redhat.com/security/cve/CVE-2022-4492","https://bugzilla.redhat.com/show_bug.cgi?id=2153260","https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/security/impl/ClientCertAuthenticationMechanism.java","https://issues.redhat.com/browse/MTA-93","https://issues.redhat.com/browse/UNDERTOW-2212","https://security.netapp.com/advisory/ntap-20230324-0002"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-pfcc-3g6r-8rg8","url":"https://osv.dev/vulnerability/GHSA-pfcc-3g6r-8rg8"}],"summary":"Undertow client not checking server identity presented by server certificate in https connections"}