GHSA-3jrv-jgp8-45v3
Undertow incorrectly parses cookies
At a glance
- Published
- Updated
- CVE
- CVE-2023-4639
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
Affected packages
| Package | Versions |
|---|---|
| Maven · io.undertow:undertow-core | introduced 2.3.0.Alpha1, fixed 2.3.11.Final |
| Maven · io.undertow:undertow-core | introduced 0, fixed 2.2.30.Final |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-4639 ADVISORY
- https://github.com/undertow-io/undertow/commit/1f93a979d2ac264798e5779b5b7172dfafe0066f WEB
- https://access.redhat.com/errata/RHSA-2024:1674 WEB
- https://access.redhat.com/errata/RHSA-2024:1675 WEB
- https://access.redhat.com/errata/RHSA-2024:1676 WEB
- https://access.redhat.com/errata/RHSA-2024:1677 WEB
- https://access.redhat.com/errata/RHSA-2024:2763 WEB
- https://access.redhat.com/errata/RHSA-2024:2764 WEB
- https://access.redhat.com/errata/RHSA-2024:3919 WEB
- https://access.redhat.com/security/cve/CVE-2023-4639 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2166022 WEB
- https://github.com/undertow-io/undertow PACKAGE
- https://security.netapp.com/advisory/ntap-20250207-0001 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |