CVE-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Score

CVSS 3.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2018-07-27

Last modified

2024-08-05

Weaknesses

CWE-444

Affected products

• Undertow (Red Hat)
• Jboss Enterprise Application Platform (Redhat)
• Undertow (Redhat)

References

• https://access.redhat.com/errata/RHSA-2017:3454
• https://access.redhat.com/errata/RHSA-2017:3455
• https://access.redhat.com/errata/RHSA-2017:3456
• https://access.redhat.com/errata/RHSA-2017:3458
• https://access.redhat.com/errata/RHSA-2018:0002
• https://access.redhat.com/errata/RHSA-2018:0003
• https://access.redhat.com/errata/RHSA-2018:0004
• https://access.redhat.com/errata/RHSA-2018:0005
• https://access.redhat.com/errata/RHSA-2018:1322
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165