PT-2018-7169 · Red Hat · Undertow

Published 2017-07-11 · Updated 2021-02-24 · CVE-2017-2666

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Undertow (affected versions not specified)

Description: A flaw was found in Undertow where the HTTP request line parsing code allowed invalid characters. This could be exploited, in conjunction with a proxy that also allowed these characters but interpreted them differently, to inject data into the HTTP response. An attacker could manipulate the HTTP response to poison a web-cache, perform a cross-site scripting (XSS) attack, or obtain sensitive information from requests other than their own.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2017-2666

DSA-3906-1

GHSA-MCFM-H73V-635M

RHSA-2017:1410

RHSA-2017:1411

RHSA-2017:1412

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

Affected Products

Undertow

References · 25

• https://debian.org/security/2017/dsa-3906 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3906-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-2666 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2666 · Security Note
• https://osv.dev/vulnerability/GHSA-mcfm-h73v-635m · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3456 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3458 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2666 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-1409.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2666 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3454 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2666 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1410 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3455 · Vendor Advisory