CVE-2022-4492: Red Hat Build Of Quarkus

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

Affected products

• Red Hat Build Of Quarkus: affected versions not specified
• Red Hat Integration Camel For Spring Boot: affected versions not specified
• Red Hat Integration Camel K: affected versions not specified
• Red Hat Integration Service Registry: affected versions not specified
• Red Hat JBoss Enterprise Application Platform: version 7.0.0 only
• Red Hat JBoss Fuse: version 7.0.0 only
• Red Hat Migration Toolkit For Applications: version 6.0 only
• Red Hat Migration Toolkit For Runtimes: affected versions not specified
• Red Hat Single Sign-On: version 7.0 only
• Red Hat Undertow: version 2.7.0 only

Published 2023-02-23. Last modified 2026-06-17.