CVE-2018-1067: CRLF Injection
A flaw was reported in WildFly 12.0.0.CR1 web server is vulnerable to the injection of arbitrary HTTP Header due to insufficient sanitisation and validation of user UTF-8 encoded input before it is used as part of an HTTP header value.
Although there is a protection against CRLF injection by detecting the presence of a NewLine character (0x0a), it can be bypassed using characters encoded in UTF-8 as the page will try to convert them back to the original Unicode form and extract the last byte.
Other sources
In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/undertowto a version that resolves this vulnerability.Fixed in 7.1.2. - Upgrade
Upgrade
WildFly 12.0.0.CR1 web serverto a version that resolves this vulnerability.Fixed in 12.0.0.CR1 - Upgrade
Upgrade
Undertowto a version that resolves this vulnerability.Fixed in 7.1.2.CR1 - Upgrade
Upgrade
Undertowto a version that resolves this vulnerability.Fixed in 7.1.2.GA
Event History
Frequently Asked Questions
What is CVE-2018-1067?
CVE-2018-1067 is a vulnerability in Undertow web server that allows for the injection of arbitrary HTTP headers and response splitting.
What versions of Undertow are affected by CVE-2018-1067?
Undertow versions before 7.1.2.CR1 and 7.1.2.GA are affected by CVE-2018-1067.
What is the severity of CVE-2018-1067?
CVE-2018-1067 has a severity rating of 6.1 (medium).
How can I fix CVE-2018-1067?
To fix CVE-2018-1067, update Undertow web server to version 7.1.2.CR1 or 7.1.2.GA.
Where can I find more information about CVE-2018-1067?
You can find more information about CVE-2018-1067 at the following references: - https://access.redhat.com/errata/RHSA-2018:1248 - https://access.redhat.com/errata/RHSA-2018:1247 - https://access.redhat.com/errata/RHSA-2018:1249