PT-2018-7169 · Red Hat · Undertow

Publicado 2017-07-11 · Atualizado 2021-02-24 · CVE-2017-2666

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Undertow (affected versions not specified)

Description: A flaw was found in Undertow where the HTTP request line parsing code allowed invalid characters. This could be exploited, in conjunction with a proxy that also allowed these characters but interpreted them differently, to inject data into the HTTP response. An attacker could manipulate the HTTP response to poison a web-cache, perform a cross-site scripting (XSS) attack, or obtain sensitive information from requests other than their own.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2017-2666

DSA-3906-1

GHSA-MCFM-H73V-635M

RHSA-2017:1410

RHSA-2017:1411

RHSA-2017:1412

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

Produtos afetados

Undertow

Referências · 25

• https://t.me/cibsecurity/24005 · Publicação no Telegram
• https://debian.org/security/2017/dsa-3906 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3906-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-2666 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2666 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2666 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mcfm-h73v-635m · Aviso do Fabricante
• https://t.me/cvenotify/10396 · Publicação no Telegram
• https://github.com/advisories/GHSA-mcfm-h73v-635m · Nota
• https://access.redhat.com/errata/RHSA-2017:3456 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3458 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-2666 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2017-1409.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2666 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3454 · Aviso do Fabricante