PT-2018-10045 · Red Hat · Undertow

Ammarit Thongthua + 2 · Publicado 2018-05-21 · Atualizado 2022-05-13 · CVE-2018-1067

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 7.1.2.CR1 Undertow versions prior to 7.1.2.GA

Description The issue is related to insufficient sanitization and validation of user input before it is used as part of an HTTP header value, allowing the injection of arbitrary HTTP headers and response splitting.

Recommendations For versions prior to 7.1.2.CR1, update to version 7.1.2.CR1 or later. For versions prior to 7.1.2.GA, update to version 7.1.2.GA or later.

Correção

Enumeração de Fraquezas

CWE-113

Identificadores relacionados

CVE-2018-1067

GHSA-47MP-RQ2X-WJF2

RHSA-2018:1247

RHSA-2018:1248

RHSA-2018:1249

RHSA-2018:2643

Produtos afetados

Undertow

Referências · 17

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1067 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:1251 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-1067 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1067 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:1249 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2643 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1067 · Nota
• https://access.redhat.com/errata/RHSA-2019:0877 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-47mp-rq2x-wjf2 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1067 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-1067 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:1247 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:1248 · Aviso do Fabricante
• https://issues.jboss.org/browse/UNDERTOW-1302 · Nota