PT-2021-13850 · Netapp+10 · Active Iq Unified Manager+3

Pedro Sampaio · Published 2021-02-23 · Updated 2022-02-22 · CVE-2021-20220

OSV

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-20220

GHSA-QJWC-V72V-FQ6R

RHSA-2021:0872

RHSA-2021:0873

RHSA-2021:0874

Affected Products

Active Iq Unified Manager

Io.Undertow:Undertow-Core

Oncommand Workflow Automation

Undertow

References · 14

• https://cve.org/CVERecord?id=CVE-2021-20220 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-20220 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1923133 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjwc-v72v-fq6r · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20220 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20220 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20220 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20220 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20220 · Vendor Advisory
• https://github.com/undertow-io/undertow/commit/9e797b2f99617fdad0471eaa88c711ee7f44605f · Note
• https://t.me/cvenotify/10396 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220210-0013 · Note
• https://t.me/cvenotify/10372 · Telegram Post
• https://t.me/cibsecurity/24005 · Telegram Post