Описание
CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
It was reported that EAP 7 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | tomcat6 | Not affected | ||
| Red Hat Enterprise Linux 7 | tomcat | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 6 | jbossweb | Not affected | ||
| Red Hat JBoss Enterprise Web Server 1 | wildfly | Affected | ||
| Red Hat JBoss Enterprise Web Server 2 | tomcat6 | Not affected | ||
| Red Hat JBoss Enterprise Web Server 2 | tomcat7 | Not affected | ||
| Red Hat JBoss Enterprise Web Server 3 | tomcat7 | Not affected | ||
| Red Hat JBoss Enterprise Web Server 3 | tomcat8 | Not affected | ||
| Red Hat JBoss Operations Network 3 | jbossweb | Not affected | ||
| Red Hat JBoss Portal 6 | jbossweb | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
5.8 Medium
CVSS2
Связанные уязвимости
CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CRLF injection vulnerability in the Undertow web server in WildFly 10. ...
Improper Neutralization of CRLF Sequences in Wildfly Undertow
EPSS
5.4 Medium
CVSS3
5.8 Medium
CVSS2