Undertow proxy handler + RequestLimit handler issue
by paroczizs
Hi Undertow Dev,
we built a custom integration component based on Wildfly 11 with Undertow
1.4.18. The application contains a couple of custom and built in handlers.
We found the following:
There is a RequestLimit handler right at the beginning and finally the
proxy handler. When the backend getting to be slow and the load is
relatively high the RequestLimit handler does its job queues the request
then throws the request above the queue. When the proxy times out it starts
to consume the queue, in some cases the exception below occurs and we found
that in this case the counter in the RequestLimit handler is not reduced
and the it can stuck the way to the backend.
Are there any possibility to handle the exception in a custom handler?
Thank you in advance, Zsolt
2018-11-28 12:02:19,518 ERROR [io.undertow.proxy] (default I/O-2) UT005028:
Proxy request to /lwi/optinus/getentityanswersservice failed:
java.nio.channels.ClosedChannelException
at
io.undertow.client.http.HttpClientConnection$5.handleEvent(HttpClientConnection.java:194)
at
io.undertow.client.http.HttpClientConnection$5.handleEvent(HttpClientConnection.java:173)
at
org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
at
org.xnio.StreamConnection.invokeCloseListener(StreamConnection.java:80)
at org.xnio.Connection.close(Connection.java:142)
at org.xnio.IoUtils.safeClose(IoUtils.java:152)
at io.undertow.util.ConnectionUtils$3.run(ConnectionUtils.java:102)
at org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:612)
at org.xnio.nio.WorkerThread.run(WorkerThread.java:479)
1 month, 1 week
Creating a websocket proxy with undertow
by Marc Boorshtein
Using the 1.4 series, I'm trying to handle upgrade and websockets. Looking
at a few examples and the code I think what I need to do is:
1. add the WebSocketServlet to the right path
2. implement WebSocketConnectionCallback that will call my remote ws://
server
Am I on the right track? I haven't found an example of doing this with
undertow but found something similar with jetty (
https://github.com/chipster/chipster-web-server/blob/master/src/main/java...)
but I havne't found the same thing for undertow so any pointers would be
appreciated.
Thanks
Marc Boorshtein
2 months, 1 week
Issue with Undertow Client and SSL
by Thomas Segismont
Hi,
Openshift Origin uses Hawkular Metrics to store node and container data. In
this scenario, Hawkular Metrics calls the Kubernetes master server over
HTTPS to validate the client identity. This is implemented with Undertow
Client, as part of a ServletExtension (inside Wildfly 10) [1]. Works fine
in development and testing.
Now the Openshit team sees errors in the logs [2][3]. I couldn't reproduce
yet. Errors come in pair, first the "UT005001: An exception occurred
processing the request: java.lang.IllegalStateException: XNIO000017: Buffer
was already freed", and just after "XNIO001007: A channel event listener
threw an exception: java.lang.NullPointerException".
Does that ring a bell? I haven't been able to find a starting point by
looking into the source the code.
Thanks
--
Thomas Segismont
JBoss ON Engineering Team
[1] https://git.io/vrNyP
[2] https://issues.jboss.org/browse/HWKMETRICS-408
[3] https://issues.jboss.org/secure/attachment/12405779/hawkular.log
3 months
Security Vulnerability CVE-2024-7885 in Undertow 2.3.17.Final
by Elemér Zágoni
The Owasp Dependency check plugin found the following Security
vulnerability in my app (even the latest 2.3.17.Final is affected):
Please address:
A vulnerability was found in Undertow where the
ProxyProtocolReadListener reuses the same StringBuilder instance
across multiple requests. This issue occurs when the
parseProxyProtocolV1 method processes multiple requests on the same
HTTP connection. As a result, different requests may share the same
StringBuilder instance, potentially leading to information leakage
between requests or responses. In some cases, a value from a previous
request or response may be erroneously reused, which could lead to
unintended data exposure. This issue primarily results in errors and
connection termination but creates a risk of data leakage in
multi-request environments.
CWE-362 Concurrent Execution using Shared Resource with Improper
Synchronization ('Race Condition')
CVSSv3:
- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- OSSINDEX - [CVE-2024-7885] CWE-362: Concurrent Execution using Shared
Resource with Improper Synchronization ('Race Condition')
<https://ossindex.sonatype.org/vulnerability/CVE-2024-7885?component-type=...>
- OSSIndex -
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7885
- OSSIndex - https://access.redhat.com/security/cve/CVE-2024-7885
Vulnerable Software & Versions (OSSINDEX):
- cpe:2.3:a:io.undertow:undertow-core:2.3.17.Final:*:*:*:*:*:*:*
*CVE-2016-6311* (OSSINDEX) suppress
Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose
internal IP addresses to remote attackers.
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVSSv3:
- Base Score: MEDIUM (5.300000190734863)
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References:
- OSSINDEX - [CVE-2016-6311] CWE-200: Information Exposure
<https://ossindex.sonatype.org/vulnerability/CVE-2016-6311?component-type=...>
- OSSIndex -
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6311
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=1362735
Vulnerable Software & Versions (OSSINDEX):
- cpe:2.3:a:io.undertow:undertow-core:2.3.17.Final:*:*:*:*:*:*:*
Thanks a lot Elemér.
1 year, 8 months
2.3.17.Final Security vulnerability: CVE-2024-7885
by Zagoni Elemer
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv3:
Base Score: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
OSSINDEX - [CVE-2024-7885] CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7885
OSSIndex - https://access.redhat.com/security/cve/CVE-2024-7885
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:io.undertow:undertow-core:2.3.17.Final:*:*:*:*:*:*:*
CVE-2016-6311 (OSSINDEX) suppress
Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose internal IP addresses to remote attackers.
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVSSv3:
Base Score: MEDIUM (5.300000190734863)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References:
OSSINDEX - [CVE-2016-6311] CWE-200: Information Exposure
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6311
OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=1362735
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:io.undertow:undertow-core:2.3.17.Final:*:*:*:*:*:*:*
1 year, 8 months
