medium6.5
CVE-2020-10719
HTTP Request Smuggling in Undertow
Impact
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | <= 2.1.0.Final | 2.1.1.Final |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Undertow | before 2.1.1 |
| Netapp | Oncommand Insight | before 7.3.13 |
| Redhat | Fuse | Version 1.0 |
| Redhat | Jboss Enterprise Application Platform | All versions Versions 7.3, 7.4, 7.2 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Single Sign-On | All versions |
| Netapp | Active Iq Unified Manager | All versions |
| Netapp | Oncommand Workflow Automation | All versions |