PT-2018-5375 · Red Hat · Undertow

Bharti Kundal · Published 2018-07-27 · Updated 2022-05-13 · CVE-2017-12165

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 1.4.17 Undertow versions prior to 1.3.31 Undertow versions prior to 2.0.0

Description It was discovered that Undertow processes HTTP request headers with unusual whitespaces, which can cause possible HTTP request smuggling.

Recommendations For versions prior to 1.4.17, update to version 1.4.17 or later. For versions prior to 1.3.31, update to version 1.3.31 or later. For versions prior to 2.0.0, update to version 2.0.0 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2017-12165

GHSA-5GG7-5WV8-4GCJ

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

RHSA-2018:0002

RHSA-2018:0004

RHSA-2018:0005

Affected Products

Undertow

References · 24

• https://access.redhat.com/errata/RHSA-2018:0005 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3454 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-12165 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3458 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0004 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12165 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0002 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12165 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1322 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0003 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12165 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3456 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12165 · Security Note