Lucene search
GoogleOSV:GHSA-6CW8-7J6C-HCCPHistoryOct 19, 2018 - 5:43 p.m.
Moderate severity vulnerability that affects io.vertx:vertx-core
2018-10-1917:43:36
Google
osv.dev
15
EPSS
0.004
Percentile
74.2%
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
References
access.redhat.com/errata/RHSA-2018:2371
access.redhat.com/errata/RHSA-2018:3768
bugs.eclipse.org/bugs/show_bug.cgi?id=536038
bugzilla.redhat.com/show_bug.cgi?id=1591072
github.com/advisories/GHSA-6cw8-7j6c-hccp
github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72
github.com/eclipse/vert.x/issues/2470
nvd.nist.gov/vuln/detail/CVE-2018-12537
www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txt
Related
veracode
veracode
HTTP Header Injection
2017-08-28 08:57:16
CRLF Injection
2018-06-21 07:33:52
redhatcve
redhatcve
CVE-2018-12537
2018-06-19 09:48:45
nvd
nvd
CVE-2018-12537
2018-08-14 19:29:00
cve
cve
CVE-2018-12537
2018-08-14 19:29:00
cvelist
cvelist
CVE-2018-12537
2018-08-14 19:00:00
prion
prion
Design/Logic Flaw
2018-08-14 19:29:00
osv
osv
CVE-2018-12537
2018-08-14 19:29:00
github
github
Moderate severity vulnerability that affects io.vertx:vertx-core
2018-10-19 17:43:36
redhat
redhat