GHSA-cp7v-vmv7-6x2q
Incorrect Authorization in Undertow
At a glance
- Published
- Updated
- CVE
- CVE-2017-12196
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
Affected packages
| Package | Versions |
|---|---|
| Maven · io.undertow:undertow-core | introduced 2.0.0.Alpha1, fixed 2.0.2.FInal |
| Maven · io.undertow:undertow-core | introduced 0, fixed 1.4.24.Final |
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-12196 ADVISORY
- https://github.com/undertow-io/undertow/commit/facb33a5cedaf4b7b96d3840a08210370a806870 WEB
- https://access.redhat.com/errata/RHSA-2018:0478 WEB
- https://access.redhat.com/errata/RHSA-2018:0479 WEB
- https://access.redhat.com/errata/RHSA-2018:0480 WEB
- https://access.redhat.com/errata/RHSA-2018:0481 WEB
- https://access.redhat.com/errata/RHSA-2018:1525 WEB
- https://access.redhat.com/errata/RHSA-2018:2405 WEB
- https://access.redhat.com/errata/RHSA-2018:3768 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196 WEB
- https://github.com/undertow-io/undertow PACKAGE
- https://issues.jboss.org/browse/UNDERTOW-1190 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |