CVE-2020-10719
Medium
Description
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
SeverityMedium
CVSS6.5
Exploit probability63. percentile1%
Product
Redhat Undertow
PublishedMay 26, 2020
First seenMay 26, 2020
Weakness typeCWE-444CWE-444
How to fix
Update
- redhat undertow2.1.1 or later
- netapp oncommand_insight7.3.13 or later
- io.undertow:undertow-core2.1.1.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat undertow | v < 2.1.1 | 2.1.1 |
| netapp oncommand_insight | v < 7.3.13 | 7.3.13 |
| redhat fuse | 1.0 | — |
| redhat jboss_enterprise_application_platform | No range specified, 7.3, 7.4, 7.2 | — |
| redhat openshift_application_runtimes | No range specified | — |
| redhat single_sign-on | No range specified | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| io.undertow:undertow-coreMaven | v < 2.1.1.Final | 2.1.1.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.