CVE-2017-7559
Description
In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
How to fix
- redhat undertow1.3.31, 1.4.17 or later
- io.undertow:undertow-core1.4.17.Final, 1.3.31.Final, 2.0.0.Alpha2 or later
- access.redhat.com/errata/RHSA-2018:1322
- access.redhat.com/errata/RHSA-2018:0002
- access.redhat.com/errata/RHSA-2017:3458
- access.redhat.com/errata/RHSA-2018:0004
- access.redhat.com/errata/RHSA-2017:3455
- access.redhat.com/errata/RHSA-2017:3456
- access.redhat.com/errata/RHSA-2018:0003
- access.redhat.com/errata/RHSA-2018:0005
- access.redhat.com/errata/RHSA-2017:3454
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat undertow | 1.3.0 ≤ v < 1.3.31, 1.4.0 ≤ v < 1.4.17, 2.0.0 | 1.3.31, 1.4.17 |
| io.undertow:undertow-coreMaven | 1.4.0 ≤ v < 1.4.17.Final, 1.3.0 ≤ v < 1.3.31.Final, 2.0.0.Alpha1 ≤ v < 2.0.0.Alpha2 | 1.4.17.Final, 1.3.31.Final, 2.0.0.Alpha2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.