PT-2018-10045

CVE-2018-1067

Published

2018-05-21

Updated

2022-05-13

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 7.1.2.CR1 Undertow versions prior to 7.1.2.GA

Description The issue is related to insufficient sanitization and validation of user input before it is used as part of an HTTP header value, allowing the injection of arbitrary HTTP headers and response splitting.

Recommendations For versions prior to 7.1.2.CR1, update to version 7.1.2.CR1 or later. For versions prior to 7.1.2.GA, update to version 7.1.2.GA or later.

Exploitability

Fix

Impacts

Researchers

Ammarit Thongthua

Laura Pardo

Nattakit Intarasorn

Vendors

Affected products

Weakness enumeration

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\'HTTP Request/Response Splitting\')

Related identifiers