PT-2018-10045 · Red Hat · Undertow

Ammarit Thongthua + 2 · Published 2018-05-21 · Updated 2022-05-13 · CVE-2018-1067

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 7.1.2.CR1 Undertow versions prior to 7.1.2.GA

Description The issue is related to insufficient sanitization and validation of user input before it is used as part of an HTTP header value, allowing the injection of arbitrary HTTP headers and response splitting.

Recommendations For versions prior to 7.1.2.CR1, update to version 7.1.2.CR1 or later. For versions prior to 7.1.2.GA, update to version 7.1.2.GA or later.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2018-1067

GHSA-47MP-RQ2X-WJF2

RHSA-2018:1247

RHSA-2018:1248

RHSA-2018:1249

RHSA-2018:2643

Affected Products

Undertow

References · 17

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1067 · Security Note
• https://access.redhat.com/errata/RHSA-2018:1251 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1067 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1067 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1249 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2643 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0877 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-47mp-rq2x-wjf2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1067 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1067 · Security Note
• https://access.redhat.com/errata/RHSA-2018:1247 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1248 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1067 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1067 · Vendor Advisory