Lucene search

K
ubuntucveUbuntu.comUB:CVE-2016-6816
HistoryNov 23, 2016 - 12:00 a.m.

CVE-2016-6816

2016-11-2300:00:00
ubuntu.com
ubuntu.com
28

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.003

Percentile

66.0%

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1
to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP
request line permitted invalid characters. This could be exploited, in
conjunction with a proxy that also permitted the invalid characters but
with a different interpretation, to inject data into the HTTP response. By
manipulating the HTTP response the attacker could poison a web-cache,
perform an XSS attack and/or obtain sensitive information from requests
other then their own.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchtomcat6< 6.0.35-1ubuntu3.9UNKNOWN
ubuntu14.04noarchtomcat6< anyUNKNOWN
ubuntu16.04noarchtomcat6< 6.0.45+dfsg-1ubuntu0.1UNKNOWN
ubuntu14.04noarchtomcat7< 7.0.52-1ubuntu0.8UNKNOWN
ubuntu16.04noarchtomcat7< 7.0.68-1ubuntu0.3UNKNOWN
ubuntu17.10noarchtomcat8< 8.0.38-2ubuntu1UNKNOWN
ubuntu18.04noarchtomcat8< 8.0.38-2ubuntu1UNKNOWN
ubuntu18.10noarchtomcat8< 8.0.38-2ubuntu1UNKNOWN
ubuntu16.04noarchtomcat8< 8.0.32-1ubuntu1.3UNKNOWN
ubuntu16.10noarchtomcat8< 8.0.37-1ubuntu0.1UNKNOWN
Rows per page:
1-10 of 111

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.003

Percentile

66.0%