Bug 1344321 (CVE-2016-4993)
Summary: | CVE-2016-4993 eap: HTTP header injection / response splitting | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | asantos, asoldano, bbaranow, bdawidow, bmaxwell, brian.stansberry, carnil, ccoleman, cdewolf, chazlett, csutherl, dandread, darran.lofthouse, dmcphers, dosoudil, iweiss, jason.greene, jawilson, jclere, jdoyle, jialiu, jkeilson, joelsmith, jokerman, jpallich, jperkins, jshepherd, jstefl, krathod, kwills, lgao, lmeyer, mbabacek, mmccomas, msochure, msvehla, mweiler, myarboro, nwallace, pmackay, pslavice, psotirop, rguimara, rnetuka, rsvoboda, sdouglas, security-response-team, smaestri, theute, tom.jenkinson, twalsh, vtunka, weli |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: |
It was reported that EAP 7 Application Server/Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-21 00:53:25 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1349290, 1349292, 1349293, 1349294, 1349295 | ||
Bug Blocks: | 1344323, 1520314 |
Description
Adam Mariš
2016-06-09 12:13:48 UTC
Acknowledgments: Name: Calum Hutton (NCC Group), Mikhail Egorov (Odin) This issue has been addressed in the following products: Via RHSA-2016:1841 https://rhn.redhat.com/errata/RHSA-2016-1841.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Via RHSA-2016:1840 https://rhn.redhat.com/errata/RHSA-2016-1840.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Via RHSA-2016:1838 https://rhn.redhat.com/errata/RHSA-2016-1838.html This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Via RHSA-2016:1839 https://rhn.redhat.com/errata/RHSA-2016-1839.html What versions of undertow are affected? Can you link to the upstream bug report? @jkeilson :Wildfly 10.0.0 is vulnerable. (In reply to Bharti Kundal from comment #26) > @jkeilson :Wildfly 10.0.0 is vulnerable. So older versions of wildfly are not affected? This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458 Hi Since this issue refers to an issue in undertow server, can you point to the respective undertow issue and/or upstream fix? Thanks in advance, Regards, Salvatore (In reply to Salvatore Bonaccorso from comment #38) > Hi > > Since this issue refers to an issue in undertow server, can you point to the > respective undertow issue and/or upstream fix? > > Thanks in advance, > > Regards, > Salvatore Hi Salvatore, Here is the upstream JIRA issue https://issues.jboss.org/browse/UNDERTOW-827. Hope this helps. Regards, Bharti |