PT-2018-8406 · Red Hat · Undertow

Published 2018-01-10 · Updated 2022-05-13 · CVE-2017-7559

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Undertow versions 1.3.x before 1.3.31.Final Undertow versions 1.4.x before 1.4.17.Final Undertow versions 2.x before 2.0.0.Alpha2

Description The issue allows invalid characters in the query string and path parameters. This could be exploited to inject data into the HTTP response, potentially leading to web-cache poisoning, XSS attacks, or obtaining sensitive information from other requests.

Recommendations For Undertow versions 1.3.x before 1.3.31.Final, update to version 1.3.31.Final or later. For Undertow versions 1.4.x before 1.4.17.Final, update to version 1.4.17.Final or later. For Undertow versions 2.x before 2.0.0.Alpha2, update to version 2.0.0.Alpha2 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2017-7559

GHSA-RJ76-H87P-R3WF

RHSA-2017:3454

RHSA-2017:3455

RHSA-2017:3458

RHSA-2018:0002

RHSA-2018:0004

RHSA-2018:0005

Affected Products

Undertow

References · 20

• https://issues.jboss.org/browse/UNDERTOW-1251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7559 · Security Note
• https://access.redhat.com/errata/RHSA-2018:0005 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7559 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3454 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3458 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7559 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0004 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7559 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7559 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7559 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0002 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1322 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0003 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rj76-h87p-r3wf · Vendor Advisory