CVE-2022-4492

What it actually does

The Undertow client omits hostname verification of the server certificate during TLS handshake for HTTPS and HTTP/2 connections, violating mandatory identity checking and enabling acceptance of certificates that do not match the target host.

Why it matters to the business

Organizations using affected Undertow versions risk undetected interception or tampering of encrypted traffic, which can expose sensitive data in transit and undermine trust in secure communications across dependent applications.

How an attack unfolds

An attacker positioned to intercept network traffic presents a forged certificate that does not match the expected hostname; because the client performs no identity check, the connection succeeds and all subsequent HTTPS traffic is readable or modifiable by the attacker.

How to fix it

Upgrade Undertow to version 2.3.8-2 or later on Debian 13 systems; after upgrade, enable explicit hostname verification in client configuration and re-test all outbound HTTPS connections.

How to confirm the fix worked

Confirm installed package version is at least 2.3.8-2, then execute controlled connections to a test server presenting a mismatched certificate and verify that the client now rejects the handshake.

Typical attack path

1. Position as network intermediary to observe or redirect HTTPS traffic destined for Undertow clients
2. Generate or obtain a certificate for a domain other than the legitimate target
3. Complete the TLS handshake without triggering client-side hostname verification
4. Decrypt, inspect, or alter application data exchanged over the connection

How to detect it

Review application and TLS library logs for connections that completed without hostname verification errors; correlate with network flow data showing traffic to unexpected endpoints or certificates issued by untrusted CAs.

What your security team should do

• Immediately schedule upgrade of all Undertow instances to the fixed version 2.3.8-2
• Audit application code for any explicit disabling of hostname verification and remove such overrides
• Add network monitoring rules to detect unexpected certificate mismatches on outbound TLS connections