{"id":"CVE-2017-12165","published":"2018-07-27T15:00:00Z","modified":"2024-08-05T18:28:16Z","title":"It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual…","vendor":"Red Hat","product":"undertow","tier":"tail","description":{"text":"It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.","provenance":"source","from":"CVE.org"},"cvss":{"score":2.6,"severity":"LOW","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01858,"percentile":0.79188,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1322","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0002","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3458","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0004","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3455","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3456","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0003","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0005","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3454","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":15.84},{"name":"CVSS severity","points":1.82}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"undertow","versions":["1.4.17","1.3.31","2.0.0"]}],"affected":[{"ecosystem":"Maven","package":"io.undertow:undertow-core","vulnerableRanges":["<1.3.31",">=1.4.0, <1.4.17",">=2.0.0.Alpha1, <2.0.0.Beta1"],"patched":["1.3.31","1.4.17","2.0.0.Beta1"],"from":["GHSA-5gg7-5wv8-4gcj"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2579","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-undertow-cve-2016-4993","parents":[{"from":"CVE-2016-4993","to":"CVE-2017-12165","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/UndertowMessages.java"],"commits":["https://github.com/undertow-io/undertow/commit/834496fb74ddda2af197940c70d08bab419fdf12","https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f"],"basis":"shared function","functions":["UndertowMessages"]}]}],"children":[{"from":"CVE-2017-12165","to":"CVE-2021-20220","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/server/Connectors.java","core/src/main/java/io/undertow/server/protocol/http/HttpRequestParser.java","core/src/main/java/io/undertow/server/protocol/http2/Http2ReceiveListener.java"],"commits":["https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f","https://github.com/undertow-io/undertow/commit/9e797b2f99617fdad0471eaa88c711ee7f44605f"],"basis":"shared function","functions":["HttpRequestParser","handleRequests"]}]},{"from":"CVE-2017-12165","to":"CVE-2024-1635","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/server/protocol/ajp/AjpReadListener.java","core/src/main/java/io/undertow/server/protocol/http/HttpRequestParser.java"],"commits":["https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f","https://github.com/undertow-io/undertow/commit/7d388c5aae9b82afb63f24e3b6a2044838dfb4de","https://github.com/undertow-io/undertow/commit/3cdb104e225f34547ce9fd6eb8799eb68e040f19"],"basis":"shared function","functions":["handleEvent","handlePath"]}]},{"from":"CVE-2017-12165","to":"CVE-2024-3884","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/server/Connectors.java","core/src/main/java/io/undertow/server/protocol/ajp/AjpRequestParser.java","core/src/main/java/io/undertow/server/protocol/http/HttpReadListener.java","core/src/main/java/io/undertow/server/protocol/http/HttpRequestParser.java","core/src/main/java/io/undertow/server/protocol/http2/Http2ReceiveListener.java"],"commits":["https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f","https://github.com/undertow-io/undertow/commit/cb854c779b9e2368c3c274ebd7217c8e75d505be"],"basis":"shared function","functions":["handleEventWithNoRunningRequest","parse"]}]},{"from":"CVE-2017-12165","to":"CVE-2024-4027","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/server/Connectors.java","core/src/main/java/io/undertow/server/protocol/ajp/AjpRequestParser.java","core/src/main/java/io/undertow/server/protocol/http/HttpReadListener.java","core/src/main/java/io/undertow/server/protocol/http/HttpRequestParser.java","core/src/main/java/io/undertow/server/protocol/http2/Http2ReceiveListener.java"],"commits":["https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f","https://github.com/undertow-io/undertow/commit/6b7c18481ce65ae4012d92fe2b7f17a21ef4d70b","https://github.com/undertow-io/undertow/commit/8318dd36fdc2c9842baf10c5f1bfbb3bc23f75e7"],"basis":"shared function","functions":["handleEventWithNoRunningRequest","parse"]}]},{"from":"CVE-2017-12165","to":"CVE-2024-6162","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/server/protocol/ajp/AjpRequestParser.java"],"commits":["https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f","https://github.com/undertow-io/undertow/commit/a28ac53076e2fa532266d25e0c0b1a01d0e9d2cf","https://github.com/undertow-io/undertow/commit/90f202ada89b6d9883beed0f1fe10c99d470d9a8"],"basis":"shared function","functions":["parse"]}]}],"packageHistory":[{"cve":"CVE-2017-2670","published":"2018-07-27","fixed":"1.3.28","kev":false,"link":{"from":"CVE-2017-2670","to":"CVE-2017-12165","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.3.28","toFixed":"1.3.31","daysApart":0}]}},{"cve":"CVE-2016-7046","published":"2016-10-03","fixed":"1.4.3.Final","kev":false,"link":{"from":"CVE-2016-7046","to":"CVE-2017-12165","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.4.3.Final","toFixed":"1.4.17","daysApart":662}]}},{"cve":"CVE-2017-2666","published":"2018-07-27","fixed":"1.4.17","kev":false},{"cve":"CVE-2017-7559","published":"2018-01-10","fixed":"2.0.0.Alpha2","kev":false,"link":{"from":"CVE-2017-7559","to":"CVE-2017-12165","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"2.0.0.Alpha2","toFixed":"2.0.0.Beta1","daysApart":198}]}},{"cve":"CVE-2017-12165","published":"2018-07-27","fixed":"2.0.0.Beta1","kev":false},{"cve":"CVE-2017-12196","published":"2018-04-18","fixed":"2.0.2.FInal","kev":false},{"cve":"CVE-2018-1114","published":"2018-09-11","fixed":"2.0.5.Final","kev":false},{"cve":"CVE-2018-14642","published":"2018-09-18","fixed":"2.0.19.FINAL","kev":false}],"package":"Maven:io.undertow:undertow-core"}}