CVE-2018-12540

The CVE-2018-12540 entry refers to Eclipse Vert.x Vert.x-Web CSRFHandler: versions 3.0.0–3.5.2 do not verify that the XSRF cookie matches the returned XSRF header/form parameter, enabling replay attacks with non-expired tokens. Public sources (including Red Hat RHSA-2018:2371 and OSV/GHSA entries...

CVE-2018-12540

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet...

CRLF Injection

Vert.x Core is vulnerable to CRLF injection. The injection is possible because it does not check to forbid the \r or \n characters in HTTP client requests and server responses...

CVE-2018-12537

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response...

Vert.x HTTP Header Injection Vulnerability

Eclipse Vert.x is a toolkit for building passive applications on the JVM. Vert.x suffers from an HTTP header injection vulnerability that stems from Vert.x failing to filter carriage returns and line breaks from value set HTTP response headers, which allows manipulation of set HTTP value headers...

Eclipse Vert.x 3.5.1 HTTP Header Injection

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Vert.x 1 CSNC ID: CSNC-2018-021 Subject: HTTP Header Injection Risk: Medium Effect: Remotely exploitable Author: Lukasz D. [email protected] Date: 12.06.2018 Introduction: ------------- Eclipse...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Application Runtimes security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...