Bug 1436163 (CVE-2017-2666)

Summary:	CVE-2017-2666 undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbaranow, bmaxwell, cdewolf, chazlett, csutherl, dandread, darran.lofthouse, dosoudil, jason.greene, jawilson, jshepherd, lgao, myarboro, pslavice, rnetuka, rsvoboda, sdouglas, security-response-team, twalsh, vtunka
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 11:52:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1481675
Bug Blocks:	1436164, 1520314

Description Adam Mariš 2017-03-27 11:27:09 UTC

It was found that code that parsed the HTTP request line in undertow permitted invalid characters which results into HTTP request smuggling vulnerability.

Comment 1 Adam Mariš 2017-03-27 11:27:20 UTC

Acknowledgments:

Name: Radim Hatlapatka (Red Hat)

Comment 3 errata-xmlrpc 2017-06-07 16:38:45 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0.6

Via RHSA-2017:1409 https://rhn.redhat.com/errata/RHSA-2017-1409.html

Comment 4 errata-xmlrpc 2017-06-07 17:05:04 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7

Via RHSA-2017:1411 https://access.redhat.com/errata/RHSA-2017:1411

Comment 5 errata-xmlrpc 2017-06-07 17:06:06 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1410 https://access.redhat.com/errata/RHSA-2017:1410

Comment 6 errata-xmlrpc 2017-06-07 17:23:14 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6

Via RHSA-2017:1412 https://access.redhat.com/errata/RHSA-2017:1412

Comment 7 Adam Mariš 2017-08-15 12:27:43 UTC

Created undertow tracking bugs for this issue:

Affects: fedora-all [bug 1481675]

Comment 9 errata-xmlrpc 2017-12-13 17:35:12 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456

Comment 10 errata-xmlrpc 2017-12-13 18:27:15 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454

Comment 11 errata-xmlrpc 2017-12-13 18:43:09 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7

Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455

Comment 12 errata-xmlrpc 2017-12-13 18:50:10 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6

Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458