Vulnerability Name:

CVE-2017-2666 (CCN-148194)

Assigned:2016-12-01
Published:2018-06-10
Updated:2019-10-09
Summary:It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-444
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2017-2666

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:1409

Source: CCN
Type: undertow Web site
JBoss Community

Source: BID
Type: Third Party Advisory, VDB Entry
98966

Source: CCN
Type: BID-98966
Red Hat Undertow CVE-2017-2666 Security Bypass Vulnerability

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:1410

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:1411

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:1412

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:3454

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:3455

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:3456

Source: REDHAT
Type: Vendor Advisory
RHSA-2017:3458

Source: CCN
Type: Red Hat Bugzilla – Bug 1436163
(CVE-2017-2666) CVE-2017-2666 undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests

Source: CONFIRM
Type: Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2666

Source: XF
Type: UNKNOWN
undertow-cve20172666-sec-bypass(148194)

Source: DEBIAN
Type: Third Party Advisory
DSA-3906

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-2666

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:undertow:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.disco:def:201726660000000
    V
    		CVE-2017-2666 on Ubuntu 19.04 (disco) - medium.
    2018-07-27
    oval:com.ubuntu.cosmic:def:201726660000000
    V
    		CVE-2017-2666 on Ubuntu 18.10 (cosmic) - medium.
    2018-07-27
    oval:com.ubuntu.bionic:def:20172666000
    V
    		CVE-2017-2666 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-07-27
    oval:com.ubuntu.bionic:def:201726660000000
    V
    		CVE-2017-2666 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-07-27
    oval:com.ubuntu.cosmic:def:20172666000
    V
    		CVE-2017-2666 on Ubuntu 18.10 (cosmic) - medium.
    2018-07-27
    oval:com.ubuntu.xenial:def:201726660000000
    V
    		CVE-2017-2666 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-07-27
    oval:com.ubuntu.xenial:def:20172666000
    V
    		CVE-2017-2666 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-07-27
    oval:com.ubuntu.artful:def:20172666000
    V
    		CVE-2017-2666 on Ubuntu 17.10 (artful) - medium.
    2017-06-08
    BACK
    redhat undertow -
    redhat jboss enterprise application platform 7.0.0
    redhat jboss enterprise application platform 7.1.0
    redhat enterprise linux 6.0
    redhat jboss enterprise application platform 7.0.0
    redhat jboss enterprise application platform 7.1.0
    redhat enterprise linux 7.0
    debian debian linux 9.0
    debian debian linux 10.0