logo
DATABASE RESOURCES PRICING ABOUT US

HTTP request smuggling in Undertow

Description

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.


Affected Software


CPE Name Name Version
io.undertow:undertow-core 1.0.0.Alpha1
io.undertow:undertow-core 1.0.0.Alpha10
io.undertow:undertow-core 1.0.0.Alpha11
io.undertow:undertow-core 1.0.0.Alpha12
io.undertow:undertow-core 1.0.0.Alpha13
io.undertow:undertow-core 1.0.0.Alpha14
io.undertow:undertow-core 1.0.0.Alpha15
io.undertow:undertow-core 1.0.0.Alpha16
io.undertow:undertow-core 1.0.0.Alpha17
io.undertow:undertow-core 1.0.0.Alpha18
io.undertow:undertow-core 1.0.0.Alpha19
io.undertow:undertow-core 1.0.0.Alpha2
io.undertow:undertow-core 1.0.0.Alpha20
io.undertow:undertow-core 1.0.0.Alpha21
io.undertow:undertow-core 1.0.0.Alpha22
io.undertow:undertow-core 1.0.0.Alpha3
io.undertow:undertow-core 1.0.0.Alpha4
io.undertow:undertow-core 1.0.0.Alpha5
io.undertow:undertow-core 1.0.0.Alpha6
io.undertow:undertow-core 1.0.0.Alpha7
io.undertow:undertow-core 1.0.0.Alpha8
io.undertow:undertow-core 1.0.0.Alpha9
io.undertow:undertow-core 1.0.0.Beta1
io.undertow:undertow-core 1.0.0.Beta10
io.undertow:undertow-core 1.0.0.Beta11
io.undertow:undertow-core 1.0.0.Beta12
io.undertow:undertow-core 1.0.0.Beta13
io.undertow:undertow-core 1.0.0.Beta14
io.undertow:undertow-core 1.0.0.Beta15
io.undertow:undertow-core 1.0.0.Beta16
io.undertow:undertow-core 1.0.0.Beta17
io.undertow:undertow-core 1.0.0.Beta18
io.undertow:undertow-core 1.0.0.Beta19
io.undertow:undertow-core 1.0.0.Beta2
io.undertow:undertow-core 1.0.0.Beta20
io.undertow:undertow-core 1.0.0.Beta21
io.undertow:undertow-core 1.0.0.Beta22
io.undertow:undertow-core 1.0.0.Beta23
io.undertow:undertow-core 1.0.0.Beta24
io.undertow:undertow-core 1.0.0.Beta25
io.undertow:undertow-core 1.0.0.Beta26
io.undertow:undertow-core 1.0.0.Beta27
io.undertow:undertow-core 1.0.0.Beta28
io.undertow:undertow-core 1.0.0.Beta29
io.undertow:undertow-core 1.0.0.Beta3
io.undertow:undertow-core 1.0.0.Beta30
io.undertow:undertow-core 1.0.0.Beta31
io.undertow:undertow-core 1.0.0.Beta32
io.undertow:undertow-core 1.0.0.Beta33
io.undertow:undertow-core 1.0.0.Beta4
io.undertow:undertow-core 1.0.0.Beta5
io.undertow:undertow-core 1.0.0.Beta6
io.undertow:undertow-core 1.0.0.Beta7
io.undertow:undertow-core 1.0.0.Beta8
io.undertow:undertow-core 1.0.0.Beta9
io.undertow:undertow-core 1.0.0.CR1
io.undertow:undertow-core 1.0.0.CR2
io.undertow:undertow-core 1.0.0.CR3
io.undertow:undertow-core 1.0.0.CR4
io.undertow:undertow-core 1.0.0.CR5
io.undertow:undertow-core 1.0.0.Final
io.undertow:undertow-core 1.0.1.Final
io.undertow:undertow-core 1.0.10.Final
io.undertow:undertow-core 1.0.11.Final
io.undertow:undertow-core 1.0.12.Final
io.undertow:undertow-core 1.0.13.Final
io.undertow:undertow-core 1.0.14.Final
io.undertow:undertow-core 1.0.15.Final
io.undertow:undertow-core 1.0.16.Final
io.undertow:undertow-core 1.0.17.Final
io.undertow:undertow-core 1.0.18.Final
io.undertow:undertow-core 1.0.19.Final
io.undertow:undertow-core 1.0.2.Final
io.undertow:undertow-core 1.0.3.Final
io.undertow:undertow-core 1.0.4.Final
io.undertow:undertow-core 1.0.5.Final
io.undertow:undertow-core 1.0.6.Final
io.undertow:undertow-core 1.0.7.Final
io.undertow:undertow-core 1.0.8.Final
io.undertow:undertow-core 1.0.9.Final
io.undertow:undertow-core 1.1.0.Beta1
io.undertow:undertow-core 1.1.0.Beta2
io.undertow:undertow-core 1.1.0.Beta3
io.undertow:undertow-core 1.1.0.Beta4
io.undertow:undertow-core 1.1.0.Beta5
io.undertow:undertow-core 1.1.0.Beta6
io.undertow:undertow-core 1.1.0.Beta7
io.undertow:undertow-core 1.1.0.Beta8
io.undertow:undertow-core 1.1.0.CR1
io.undertow:undertow-core 1.1.0.CR2
io.undertow:undertow-core 1.1.0.CR3
io.undertow:undertow-core 1.1.0.CR4
io.undertow:undertow-core 1.1.0.CR5
io.undertow:undertow-core 1.1.0.CR6
io.undertow:undertow-core 1.1.0.CR7
io.undertow:undertow-core 1.1.0.CR8
io.undertow:undertow-core 1.1.0.Final
io.undertow:undertow-core 1.1.1.Final
io.undertow:undertow-core 1.1.2.Final
io.undertow:undertow-core 1.1.3.Final
io.undertow:undertow-core 1.1.4.Final
io.undertow:undertow-core 1.1.5.Final
io.undertow:undertow-core 1.1.6.Final
io.undertow:undertow-core 1.1.7.Final
io.undertow:undertow-core 1.1.8.Final
io.undertow:undertow-core 1.1.9.Final
io.undertow:undertow-core 1.2.0.Beta1
io.undertow:undertow-core 1.2.0.Beta10
io.undertow:undertow-core 1.2.0.Beta2
io.undertow:undertow-core 1.2.0.Beta3
io.undertow:undertow-core 1.2.0.Beta4
io.undertow:undertow-core 1.2.0.Beta5
io.undertow:undertow-core 1.2.0.Beta6
io.undertow:undertow-core 1.2.0.Beta7
io.undertow:undertow-core 1.2.0.Beta8
io.undertow:undertow-core 1.2.0.Beta9
io.undertow:undertow-core 1.2.0.CR1
io.undertow:undertow-core 1.2.0.Final
io.undertow:undertow-core 1.2.1.Final
io.undertow:undertow-core 1.2.10.Final
io.undertow:undertow-core 1.2.11.Final
io.undertow:undertow-core 1.2.12.Final
io.undertow:undertow-core 1.2.2.Final
io.undertow:undertow-core 1.2.3.Final
io.undertow:undertow-core 1.2.4.Final
io.undertow:undertow-core 1.2.5.Final
io.undertow:undertow-core 1.2.6.Final
io.undertow:undertow-core 1.2.7.Final
io.undertow:undertow-core 1.2.8.Final
io.undertow:undertow-core 1.2.9.Final
io.undertow:undertow-core 1.3.0.Beta1
io.undertow:undertow-core 1.3.0.Beta10
io.undertow:undertow-core 1.3.0.Beta11
io.undertow:undertow-core 1.3.0.Beta12
io.undertow:undertow-core 1.3.0.Beta13
io.undertow:undertow-core 1.3.0.Beta2
io.undertow:undertow-core 1.3.0.Beta3
io.undertow:undertow-core 1.3.0.Beta4
io.undertow:undertow-core 1.3.0.Beta5
io.undertow:undertow-core 1.3.0.Beta6
io.undertow:undertow-core 1.3.0.Beta7
io.undertow:undertow-core 1.3.0.Beta8
io.undertow:undertow-core 1.3.0.Beta9
io.undertow:undertow-core 1.3.0.CR1
io.undertow:undertow-core 1.3.0.CR2
io.undertow:undertow-core 1.3.0.CR3
io.undertow:undertow-core 1.3.0.Final
io.undertow:undertow-core 1.3.1.Final
io.undertow:undertow-core 1.3.10.Final
io.undertow:undertow-core 1.3.11.Final
io.undertow:undertow-core 1.3.12.Final
io.undertow:undertow-core 1.3.13.Final
io.undertow:undertow-core 1.3.14.Final
io.undertow:undertow-core 1.3.15.Final
io.undertow:undertow-core 1.3.16.Final
io.undertow:undertow-core 1.3.17.Final
io.undertow:undertow-core 1.3.18.Final
io.undertow:undertow-core 1.3.19.Final
io.undertow:undertow-core 1.3.2.Final
io.undertow:undertow-core 1.3.20.Final
io.undertow:undertow-core 1.3.21.Final
io.undertow:undertow-core 1.3.22.Final
io.undertow:undertow-core 1.3.23.Final
io.undertow:undertow-core 1.3.24.Final
io.undertow:undertow-core 1.3.25.Final
io.undertow:undertow-core 1.3.26.Final
io.undertow:undertow-core 1.3.27.Final
io.undertow:undertow-core 1.3.28.Final
io.undertow:undertow-core 1.3.29.Final
io.undertow:undertow-core 1.3.3.Final
io.undertow:undertow-core 1.3.30.Final
io.undertow:undertow-core 1.3.31.Final
io.undertow:undertow-core 1.3.32.Final
io.undertow:undertow-core 1.3.33.Final
io.undertow:undertow-core 1.3.4.Final
io.undertow:undertow-core 1.3.5.Final
io.undertow:undertow-core 1.3.6.Final
io.undertow:undertow-core 1.3.7.Final
io.undertow:undertow-core 1.3.8.Final
io.undertow:undertow-core 1.3.9.Final
io.undertow:undertow-core 1.4.0.Beta1
io.undertow:undertow-core 1.4.0.CR1
io.undertow:undertow-core 1.4.0.CR2
io.undertow:undertow-core 1.4.0.CR3
io.undertow:undertow-core 1.4.0.CR4
io.undertow:undertow-core 1.4.0.Final
io.undertow:undertow-core 1.4.1.Final
io.undertow:undertow-core 1.4.10.Final
io.undertow:undertow-core 1.4.11.Final
io.undertow:undertow-core 1.4.12.Final
io.undertow:undertow-core 1.4.13.Final
io.undertow:undertow-core 1.4.14.Final
io.undertow:undertow-core 1.4.15.Final
io.undertow:undertow-core 1.4.16.Final
io.undertow:undertow-core 1.4.17.Final
io.undertow:undertow-core 1.4.18.Final
io.undertow:undertow-core 1.4.19.Final
io.undertow:undertow-core 1.4.2.Final
io.undertow:undertow-core 1.4.20.Final
io.undertow:undertow-core 1.4.21.Final
io.undertow:undertow-core 1.4.22.Final
io.undertow:undertow-core 1.4.23.Final
io.undertow:undertow-core 1.4.24.Final
io.undertow:undertow-core 1.4.25.Final
io.undertow:undertow-core 1.4.26.Final
io.undertow:undertow-core 1.4.27.Final
io.undertow:undertow-core 1.4.28.Final
io.undertow:undertow-core 1.4.3.Final
io.undertow:undertow-core 1.4.4.Final
io.undertow:undertow-core 1.4.5.Final
io.undertow:undertow-core 1.4.6.Final
io.undertow:undertow-core 1.4.7.Final
io.undertow:undertow-core 1.4.8.Final
io.undertow:undertow-core 1.4.9.Final
io.undertow:undertow-core 2.0.0.Alpha1
io.undertow:undertow-core 2.0.0.Beta1
io.undertow:undertow-core 2.0.0.Final
io.undertow:undertow-core 2.0.1.Final
io.undertow:undertow-core 2.0.10.Final
io.undertow:undertow-core 2.0.11.Final
io.undertow:undertow-core 2.0.12.Final
io.undertow:undertow-core 2.0.13.Final
io.undertow:undertow-core 2.0.14.Final
io.undertow:undertow-core 2.0.15.Final
io.undertow:undertow-core 2.0.16.Final
io.undertow:undertow-core 2.0.17.Final
io.undertow:undertow-core 2.0.18.Final
io.undertow:undertow-core 2.0.19.Final
io.undertow:undertow-core 2.0.2.Final
io.undertow:undertow-core 2.0.20.Final
io.undertow:undertow-core 2.0.21.Final
io.undertow:undertow-core 2.0.22.Final
io.undertow:undertow-core 2.0.23.Final
io.undertow:undertow-core 2.0.24.Final
io.undertow:undertow-core 2.0.25.Final
io.undertow:undertow-core 2.0.26.Final
io.undertow:undertow-core 2.0.27.Final
io.undertow:undertow-core 2.0.28.Final
io.undertow:undertow-core 2.0.29.Final
io.undertow:undertow-core 2.0.3.Final
io.undertow:undertow-core 2.0.30.Final
io.undertow:undertow-core 2.0.31.Final
io.undertow:undertow-core 2.0.32.Final
io.undertow:undertow-core 2.0.33.Final
io.undertow:undertow-core 2.0.4.Final
io.undertow:undertow-core 2.0.5.Final
io.undertow:undertow-core 2.0.6.Final
io.undertow:undertow-core 2.0.7.Final
io.undertow:undertow-core 2.0.8.Final
io.undertow:undertow-core 2.0.9.Final

Related