high7.5
CVE-2017-12165
Undertow Request Smuggling vulnerability
Impact
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | < 1.3.31 | 1.3.31 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Undertow | from 1.0.0 before 1.3.31 from 1.4.0 before 1.4.17 Version 2.0.0 |
| Redhat | Jboss Enterprise Application Platform | Versions 7.0.0, 7.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2017:3454
- https://access.redhat.com/errata/RHSA-2017:3455
- https://access.redhat.com/errata/RHSA-2017:3456
- https://access.redhat.com/errata/RHSA-2017:3458
- https://access.redhat.com/errata/RHSA-2018:0002
- https://access.redhat.com/errata/RHSA-2018:0003
- https://access.redhat.com/errata/RHSA-2018:0004
- https://access.redhat.com/errata/RHSA-2018:0005
- https://access.redhat.com/errata/RHSA-2018:1322
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165
- https://github.com/advisories/GHSA-5gg7-5wv8-4gcj
- https://nvd.nist.gov/vuln/detail/CVE-2017-12165
- https://issues.redhat.com/browse/UNDERTOW-1251
- https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f
- https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f
- https://github.com/undertow-io/undertow/commit/691440ee58259fba76711b60d56dde6679808bdc