PT-2020-12284 · Red Hat · Undertow

Published 2020-09-23 · Updated 2022-02-22 · CVE-2020-10687

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.2.0.Final

Description A flaw was discovered in Undertow that allows HTTP request smuggling against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This issue can be exploited to poison a web-cache, perform a cross-site scripting (XSS) attack, or obtain sensitive information from requests other than the attacker's own.

Recommendations For versions prior to 2.2.0.Final, update to Undertow 2.2.0.Final to resolve the issue. As a temporary workaround, consider restricting HTTP requests to prevent invalid characters from being processed until a patch is available.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2020-10687

GHSA-P9W3-GWC2-CR49

RHSA-2020:3461

RHSA-2020:3462

RHSA-2020:3463

RHSA-2020:3637

RHSA-2020:3638

RHSA-2020:3639

RHSA-2021:0872

RHSA-2021:0873

RHSA-2021:0874

Affected Products

Undertow

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2020-10687 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-10687 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1785049 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10687 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10687 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10687 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10687 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9w3-gwc2-cr49 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10687 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220210-0015 · Note
• https://t.me/cvenotify/10372 · Telegram Post
• https://t.me/cvenotify/10396 · Telegram Post
• https://t.me/cibsecurity/24005 · Telegram Post
• https://t.me/cvenotify/9101 · Telegram Post
• https://lists.apache.org/thread.html/r6603513ea8afbf6857fd77ca5888ec8385d0af493baa4250e28c351c@%3Cdev.cxf.apache.org%3E · Note