First published: Mon Apr 13 2020(Updated: )
A CRLF injection flaw was found in the Lightweight HTTP Server component of OpenJDK. The HttpServer implementation did not restrict the use of CR and LF characters in values for HTTP headers, possibly allowing HTTP response splitting attacks.
Credit: secalert_us@oracle.com secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 |
redhat/java | <1.7.0-openjdk-1:1.7.0.261-2.6.22.1.el6_10 | 1.7.0-openjdk-1:1.7.0.261-2.6.22.1.el6_10 |
redhat/java | <1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10 | 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10 | 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10 |
redhat/java | <1.7.0-openjdk-1:1.7.0.261-2.6.22.2.el7_8 | 1.7.0-openjdk-1:1.7.0.261-2.6.22.2.el7_8 |
redhat/java | <11-openjdk-1:11.0.7.10-4.el7_8 | 11-openjdk-1:11.0.7.10-4.el7_8 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el7_8 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el7_8 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7 |
redhat/java | <1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7 | 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7 |
redhat/java | <11-openjdk-1:11.0.7.10-1.el8_1 | 11-openjdk-1:11.0.7.10-1.el8_1 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el8_1 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_1 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1.el8_2 | 1.8.0-ibm-1:1.8.0.6.10-1.el8_2 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el8_0 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_0 |
redhat/java | <11-openjdk-1:11.0.7.10-1.el8_0 | 11-openjdk-1:11.0.7.10-1.el8_0 |
Oracle JDK | =1.7.0-update251 | |
Oracle JDK | =1.8.0-update241 | |
Oracle JDK | =11.0.6 | |
Oracle JDK | =14.0.0 | |
Oracle JRE | =1.7.0-update_251 | |
Oracle JRE | =1.8.0-update_241 | |
Oracle JRE | =11.0.6 | |
Oracle JRE | =14.0.0 | |
Oracle OpenJDK | >=11<=11.0.6 | |
Oracle OpenJDK | >=13<=13.0.2 | |
Oracle OpenJDK | =7 | |
Oracle OpenJDK | =7-update1 | |
Oracle OpenJDK | =7-update10 | |
Oracle OpenJDK | =7-update101 | |
Oracle OpenJDK | =7-update11 | |
Oracle OpenJDK | =7-update111 | |
Oracle OpenJDK | =7-update121 | |
Oracle OpenJDK | =7-update13 | |
Oracle OpenJDK | =7-update131 | |
Oracle OpenJDK | =7-update141 | |
Oracle OpenJDK | =7-update15 | |
Oracle OpenJDK | =7-update151 | |
Oracle OpenJDK | =7-update161 | |
Oracle OpenJDK | =7-update17 | |
Oracle OpenJDK | =7-update171 | |
Oracle OpenJDK | =7-update181 | |
Oracle OpenJDK | =7-update191 | |
Oracle OpenJDK | =7-update2 | |
Oracle OpenJDK | =7-update201 | |
Oracle OpenJDK | =7-update21 | |
Oracle OpenJDK | =7-update211 | |
Oracle OpenJDK | =7-update221 | |
Oracle OpenJDK | =7-update231 | |
Oracle OpenJDK | =7-update241 | |
Oracle OpenJDK | =7-update25 | |
Oracle OpenJDK | =7-update251 | |
Oracle OpenJDK | =7-update3 | |
Oracle OpenJDK | =7-update4 | |
Oracle OpenJDK | =7-update40 | |
Oracle OpenJDK | =7-update45 | |
Oracle OpenJDK | =7-update5 | |
Oracle OpenJDK | =7-update51 | |
Oracle OpenJDK | =7-update55 | |
Oracle OpenJDK | =7-update6 | |
Oracle OpenJDK | =7-update60 | |
Oracle OpenJDK | =7-update65 | |
Oracle OpenJDK | =7-update67 | |
Oracle OpenJDK | =7-update7 | |
Oracle OpenJDK | =7-update72 | |
Oracle OpenJDK | =7-update76 | |
Oracle OpenJDK | =7-update80 | |
Oracle OpenJDK | =7-update85 | |
Oracle OpenJDK | =7-update9 | |
Oracle OpenJDK | =7-update91 | |
Oracle OpenJDK | =7-update95 | |
Oracle OpenJDK | =7-update97 | |
Oracle OpenJDK | =7-update99 | |
Oracle OpenJDK | =8 | |
Oracle OpenJDK | =8-update101 | |
Oracle OpenJDK | =8-update102 | |
Oracle OpenJDK | =8-update11 | |
Oracle OpenJDK | =8-update111 | |
Oracle OpenJDK | =8-update112 | |
Oracle OpenJDK | =8-update121 | |
Oracle OpenJDK | =8-update131 | |
Oracle OpenJDK | =8-update141 | |
Oracle OpenJDK | =8-update151 | |
Oracle OpenJDK | =8-update152 | |
Oracle OpenJDK | =8-update161 | |
Oracle OpenJDK | =8-update162 | |
Oracle OpenJDK | =8-update171 | |
Oracle OpenJDK | =8-update172 | |
Oracle OpenJDK | =8-update181 | |
Oracle OpenJDK | =8-update191 | |
Oracle OpenJDK | =8-update192 | |
Oracle OpenJDK | =8-update20 | |
Oracle OpenJDK | =8-update201 | |
Oracle OpenJDK | =8-update202 | |
Oracle OpenJDK | =8-update211 | |
Oracle OpenJDK | =8-update212 | |
Oracle OpenJDK | =8-update221 | |
Oracle OpenJDK | =8-update231 | |
Oracle OpenJDK | =8-update241 | |
Oracle OpenJDK | =8-update25 | |
Oracle OpenJDK | =8-update31 | |
Oracle OpenJDK | =8-update40 | |
Oracle OpenJDK | =8-update45 | |
Oracle OpenJDK | =8-update5 | |
Oracle OpenJDK | =8-update51 | |
Oracle OpenJDK | =8-update60 | |
Oracle OpenJDK | =8-update65 | |
Oracle OpenJDK | =8-update66 | |
Oracle OpenJDK | =8-update71 | |
Oracle OpenJDK | =8-update72 | |
Oracle OpenJDK | =8-update73 | |
Oracle OpenJDK | =8-update74 | |
Oracle OpenJDK | =8-update77 | |
Oracle OpenJDK | =8-update91 | |
Oracle OpenJDK | =8-update92 | |
Oracle OpenJDK | =14 | |
NetApp 7-Mode Transition Tool | ||
Netapp Active Iq Unified Manager Windows | >=7.3 | |
Netapp Active Iq Unified Manager Vsphere | >=9.5 | |
Netapp Cloud Backup | ||
Netapp E-series Performance Analyzer | ||
NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.70.2 | |
Netapp E-series Santricity Web Services Web Services Proxy | ||
NetApp OnCommand Insight | ||
NetApp OnCommand Workflow Automation | ||
Netapp Plug-in For Symantec Netbackup | ||
Netapp Santricity Unified Manager | ||
Netapp Snapmanager Sap | ||
Netapp Snapmanager Oracle | ||
Netapp Steelstore Cloud Integrated Storage | ||
Netapp Storagegrid | >=9.0.0<=9.0.4 | |
Netapp Storagegrid | ||
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Debian Debian Linux | =10.0 | |
Fedoraproject Fedora | =30 | |
Fedoraproject Fedora | =31 | |
Fedoraproject Fedora | =32 | |
openSUSE Leap | =15.1 | |
openSUSE Leap | =15.2 | |
Canonical Ubuntu Linux | =16.04 | |
Canonical Ubuntu Linux | =18.04 | |
Canonical Ubuntu Linux | =19.10 | |
IBM Engineering Requirements Quality Assistant On-Premises | <=All | |
debian/openjdk-11 | 11.0.24+8-2~deb11u1 11.0.25~5ea-1 | |
debian/openjdk-8 | 8u422-b05-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)