It was discovered in Undertow that the code that parsed...
Vulnerability Description
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-2666
Credits & Attribution
No credits recorded in the NVD database.
References
- https://access.redhat.com/errata/RHSA-2017:1411
- http://rhn.redhat.com/errata/RHSA-2017-1409.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2666
- https://www.debian.org/security/2017/dsa-3906
- https://access.redhat.com/errata/RHSA-2017:3458
- https://access.redhat.com/errata/RHSA-2017:1410
- https://access.redhat.com/errata/RHSA-2017:1412
- https://access.redhat.com/errata/RHSA-2017:3455
- https://access.redhat.com/errata/RHSA-2017:3456
- http://www.securityfocus.com/bid/98966
- https://access.redhat.com/errata/RHSA-2017:3454
More from [UNKNOWN]
View All →Affected Vendor
[UNKNOWN]
View all reports →