It was discovered that Undertow processes http request headers with unusual whitespaces which can cause possible http request smuggling.
Acknowledgments: Name: Stuart Douglas (Red Hat)
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458
Could you share more information about the vulnerability please? What is the fixing commit in undertow's Git repository? https://github.com/undertow-io/undertow
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2018:0003 https://access.redhat.com/errata/RHSA-2018:0003
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Via RHSA-2018:0002 https://access.redhat.com/errata/RHSA-2018:0002
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Via RHSA-2018:0004 https://access.redhat.com/errata/RHSA-2018:0004
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Via RHSA-2018:0005 https://access.redhat.com/errata/RHSA-2018:0005
(In reply to Markus Koschany from comment #9) > Could you share more information about the vulnerability please? What is the > fixing commit in undertow's Git repository? > > https://github.com/undertow-io/undertow Hi Markus, Seems that this is being tracked here :https://issues.jboss.org/browse/UNDERTOW-1251 as far as I know.You can agther more information there. Please let me know if you need more help. Regards, Bharti
This issue has been addressed in the following products: Red Hat JBoss Fuse Via RHSA-2018:1322 https://access.redhat.com/errata/RHSA-2018:1322