Loading...

XML

Word

Printable

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: 2.3.0.Alpha1, 2.3.0.Final, 2.2.18.Final, 2.2.17.SP1, 2.2.17.SP3, 2.2.17.SP2
Affects Version/s: None
Component/s: None
Labels:
None

Git Pull Request:
https://gitlab.cee.redhat.com/undertow-io/undertow/-/merge_requests/50, https://gitlab.cee.redhat.com/undertow-io/undertow/-/merge_requests/52, https://github.com/undertow-io/undertow/pull/1312, https://github.com/undertow-io/undertow/pull/1329

Currently, the awaitWritable methods are not looping on wait to protect against spurious wakes:

https://github.com/undertow-io/undertow/blob/2.2.16.Final/core/src/main/java/io/undertow/server/protocol/framed/AbstractFramedStreamSinkChannel.java#L288

is caused by

UNDERTOW-1910 CVE-2021-3629 AbstractFramedStreamSinkChannel.awaitWritable() never returns if peer fails to update HTTP2 window

Resolved

is incorporated by

WFCORE-6057 Upgrade Undertow to 2.3.0.Final (CVE-2022-2764)

Closed

WFCORE-5946 Upgrade Undertow to 2.2.18.Final

Closed

is related to

UNDERTOW-2039 Convert AbstractFramedChannel.AWAIT_WRITABLE_TIMEOUT to nanoseconds

Pull Request Sent

Assignee:: Flavia Rainone

Reporter:: Flavia Rainone

Involved:: Brad Maxwell, David Lloyd, Flavia Rainone, Grzegorz Grzybek, Jason Lee, Joerg Baesner, Kunjan Rathod (Inactive), Masafumi Miura, Richard Opalka, Rodrigo Freire, Stefano Maestri, Stuart Douglas

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Created:: 2022/02/22 3:18 AM

Updated:: 2022/12/09 11:26 AM

Resolved:: 2022/04/04 3:01 PM