GHSA-cccf-7xw3-p2vr: Medium severity Red Hat Undertow vulnerability

Q: Which Undertow versions are affected?

Undertow versions before 2.1.1.Final are affected by this flaw.

Q: What does an attacker need to exploit this issue?

The issue is remotely exploitable over the network with low attack complexity. The supplied vector indicates that no privileges or user interaction are required.

Q: What is the practical impact of successful exploitation?

An attacker can exploit invalid HTTP requests with large chunk sizes to perform HTTP request smuggling. The reported impact includes low confidentiality and integrity impact, with no availability impact.

Published May 26, 2020

Updated

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

Affected Software

1 affected component

Red Hat Undertow<2.1.1.Final

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Undertow to a version that resolves this vulnerability.
Fixed in 2.1.1.Final

Event History

May 26, 2020

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverity

Frequently Asked Questions

Which Undertow versions are affected?

Undertow versions before 2.1.1.Final are affected by this flaw.

What does an attacker need to exploit this issue?

The issue is remotely exploitable over the network with low attack complexity. The supplied vector indicates that no privileges or user interaction are required.

What is the practical impact of successful exploitation?

An attacker can exploit invalid HTTP requests with large chunk sizes to perform HTTP request smuggling. The reported impact includes low confidentiality and integrity impact, with no availability impact.

GHSA-cccf-7xw3-p2vr: Medium severity Red Hat Undertow vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Undertow versions are affected?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Undertow versions are affected?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?