REDHAT-BUG-1344321: Medium severity WildFly WildFly Application Server vulnerability
It was reported that WildFly 10.0.0 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also Response Splitting, due to insufficient sanitisation and validation of user input before the input is used as part of a HTTP header value.
Using newline characters injected into the HTTP headers, it is possible for the malicious user to add arbitrary headers such as Set-Cookie to set arbitrary cookies, or potentially use a Location header for an open-redirect. By using two newline characters the attacker can 'split' the response (HTTP Response Splitting) and provide their own content that will be rendered to the victim user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1344321?
The severity of REDHAT-BUG-1344321 is considered high due to the potential for arbitrary HTTP header injection and response splitting.
How do I fix REDHAT-BUG-1344321?
To fix REDHAT-BUG-1344321, ensure proper sanitization and validation of user inputs used in HTTP header values.
Which software is affected by REDHAT-BUG-1344321?
REDHAT-BUG-1344321 affects WildFly 10.0.0 Application Server and WildFly Undertow web server.
What impact does REDHAT-BUG-1344321 have on users?
The impact of REDHAT-BUG-1344321 can lead to security vulnerabilities such as HTTP response splitting and improper handling of user data.
Is there a workaround for REDHAT-BUG-1344321?
Currently, the best workaround for REDHAT-BUG-1344321 involves temporarily restricting user input in header fields until a patch can be applied.