Lucene search

Veracode Vulnerability DatabaseVERACODE:5701

HistoryJan 15, 2018 - 6:04 a.m.

Denial Of Service (DoS)

2018-01-1506:04:20

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

undertow-core is vulnerable to denial of service (DoS) attacks. The application does not check if the HTTP header values it receives are null, allowing a malicious user to pass null header values to fill the heap and cause resource exhaustion.

CPENameOperatorVersion
undertow corele1.4.7.Final
eap7-wildflyeq7.0.0__19.GA_redhat_3.1.ep7.el6
eap7-wildflyeq7.0.5__3.GA_redhat_2.1.ep7.el6
eap7-wildflyeq7.0.4__4.GA_redhat_2.1.ep7.el6
eap7-wildflyeq7.0.5__3.GA_redhat_2.1.ep7.el7
eap7-wildflyeq7.0.0__19.GA_redhat_3.1.ep7.el7
eap7-wildflyeq7.0.9__4.GA_redhat_3.1.ep7.el7
eap7-wildflyeq7.0.2__2.GA_redhat_1.1.ep7.el6
eap7-wildflyeq7.0.1__4.GA_redhat_2.1.ep7.el7
eap7-wildflyeq7.0.4__4.GA_redhat_2.1.ep7.el7

Name	Operator	Version
undertow core	le	1.4.7.Final
eap7-wildfly	eq	7.0.0__19.GA_redhat_3.1.ep7.el6
eap7-wildfly	eq	7.0.5__3.GA_redhat_2.1.ep7.el6
eap7-wildfly	eq	7.0.4__4.GA_redhat_2.1.ep7.el6
eap7-wildfly	eq	7.0.5__3.GA_redhat_2.1.ep7.el7
eap7-wildfly	eq	7.0.0__19.GA_redhat_3.1.ep7.el7
eap7-wildfly	eq	7.0.9__4.GA_redhat_3.1.ep7.el7
eap7-wildfly	eq	7.0.2__2.GA_redhat_1.1.ep7.el6
eap7-wildfly	eq	7.0.1__4.GA_redhat_2.1.ep7.el7
eap7-wildfly	eq	7.0.4__4.GA_redhat_2.1.ep7.el7

Rows per page:

1-10 of 5031

References

rhn.redhat.com/errata/RHSA-2017-0830.html

rhn.redhat.com/errata/RHSA-2017-0831.html

rhn.redhat.com/errata/RHSA-2017-0832.html

rhn.redhat.com/errata/RHSA-2017-0834.html

rhn.redhat.com/errata/RHSA-2017-0876.html

www.securityfocus.com/bid/97060

access.redhat.com/errata/RHSA-2017:0872

access.redhat.com/errata/RHSA-2017:0873

access.redhat.com/errata/RHSA-2017:3454

access.redhat.com/errata/RHSA-2017:3455

access.redhat.com/errata/RHSA-2017:3456

access.redhat.com/errata/RHSA-2017:3458

bugzilla.redhat.com/show_bug.cgi?id=1404782

github.com/undertow-io/undertow/commit/86d52a5e9198991fe30a3616d9008cecc696fc0b

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

JSON

Related for VERACODE:5701