Lucene search

RedhatCVE-2017-12165

HistoryJul 27, 2018 - 3:29 p.m.

CVE-2017-12165

2018-07-2715:29:00

CWE-444

redhat

web.nvd.nist.gov

396

undertow

cve-2017-12165

http request smuggling

vulnerability

security

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.4

Confidence

High

EPSS

0.005

Percentile

75.6%

JSON

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Affected configurations

Nvd

Vulners

Node

redhatundertowRange1.0.0–1.3.31

redhatundertowRange1.4.0–1.4.17

redhatundertowMatch2.0.0alpha_1

Node

redhatjboss_enterprise_application_platformMatch7.0.0

redhatjboss_enterprise_application_platformMatch7.1.0

VendorProductVersionCPE
redhatundertow*cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
redhatundertow2.0.0cpe:2.3:a:redhat:undertow:2.0.0:alpha_1:*:*:*:*:*:*
redhatjboss_enterprise_application_platform7.0.0cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
redhatjboss_enterprise_application_platform7.1.0cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	undertow	*	cpe:2.3:a:redhat:undertow::::::::
redhat	undertow	2.0.0	cpe:2.3:a:redhat:undertow:2.0.0:alpha_1::::::
redhat	jboss_enterprise_application_platform	7.0.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:::::::*
redhat	jboss_enterprise_application_platform	7.1.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:::::::*

CNA Affected

[
  {
    "product": "undertow",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.17"
      },
      {
        "status": "affected",
        "version": "1.3.31"
      },
      {
        "status": "affected",
        "version": "2.0.0"
      }
    ]
  }
]