PT-2016-6208 · Red Hat · Red Hat Jboss Enterprise Application Platform+2

Calum Hutton + 1 · Published 2016-09-26 · Updated 2022-05-17 · CVE-2016-4993

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WildFly version 10.0.0 Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 7.0.2

Description A CRLF injection issue in the Undertow web server allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.

Recommendations For WildFly version 10.0.0, update to a version that fixes the CRLF injection vulnerability. For Red Hat JBoss Enterprise Application Platform (EAP) versions prior to 7.0.2, update to version 7.0.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-93

CWE-113

Related Identifiers

CVE-2016-4993

GHSA-QCQR-HCJQ-WHFQ

RHSA-2016:1838

RHSA-2016:1839

RHSA-2016:1840

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

Affected Products

Red Hat Jboss Enterprise Application Platform

Undertow

Wildfly

References · 23

• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4993 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3458 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4993 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4993 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4993 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3454 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1838.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3455 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcqr-hcjq-whfq · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3456 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4993 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1840.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4993 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-4993 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1841.html · Vendor Advisory