PT-2016-6208 · Red Hat · Red Hat Jboss Enterprise Application Platform+2

Calum Hutton + 1 · Publicado 2016-09-26 · Atualizado 2022-05-17 · CVE-2016-4993

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WildFly version 10.0.0 Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 7.0.2

Description A CRLF injection issue in the Undertow web server allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.

Recommendations For WildFly version 10.0.0, update to a version that fixes the CRLF injection vulnerability. For Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 7.0.2, update to version 7.0.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-93

CWE-113

Identificadores relacionados

CVE-2016-4993

GHSA-QCQR-HCJQ-WHFQ

RHSA-2016:1838

RHSA-2016:1839

RHSA-2016:1840

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

Produtos afetados

Red Hat Jboss Enterprise Application Platform

Undertow

Wildfly

Referências · 23

• https://github.com/undertow-io/undertow/commit/834496fb74ddda2af197940c70d08bab419fdf12 · Nota
• http://securityfocus.com/bid/92894 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4993 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3458 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-4993 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4993 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4993 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3454 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-1838.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3455 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qcqr-hcjq-whfq · Aviso do Fabricante
• https://issues.jboss.org/browse/UNDERTOW-827 · Nota
• https://access.redhat.com/errata/RHSA-2017:3456 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1344321 · Nota
• https://osv.dev/vulnerability/CVE-2016-4993 · Aviso do Fabricante