{"id":"CVE-2017-2666","published":"2018-07-27T14:00:00Z","modified":"2024-08-05T14:02:07Z","title":"It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters","vendor":null,"product":"undertow","tier":"tail","description":{"text":"It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03095,"percentile":0.87702,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:1411","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-1409.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2666","tags":["x_refsource_CONFIRM"]},{"url":"https://www.debian.org/security/2017/dsa-3906","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3458","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1410","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1412","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3455","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3456","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/98966","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3454","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":22.1,"factors":[{"name":"EPSS percentile","points":17.54},{"name":"CVSS severity","points":4.55}]},"affected":[{"ecosystem":"Maven","package":"io.undertow:undertow-core","vulnerableRanges":["<1.3.31",">=1.4.0, <1.4.17"],"patched":["1.3.31","1.4.17"],"from":["GHSA-mcfm-h73v-635m"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0639","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-undertow-cve-2016-4993","children":[{"from":"CVE-2017-2666","to":"CVE-2017-7559","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters.","from":"CVE.org","in":"CVE-2017-7559"},{"kind":"similar","provenance":"machine","score":0.76,"basis":"same package + description similarity"}]},{"from":"CVE-2017-2666","to":"CVE-2020-10687","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request.","from":"CVE.org","in":"CVE-2020-10687"},{"kind":"similar","provenance":"machine","score":0.5,"basis":"same package + description similarity"}]},{"from":"CVE-2017-2666","to":"CVE-2021-20220","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request.","from":"CVE.org","in":"CVE-2021-20220"},{"kind":"similar","provenance":"machine","score":0.44,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2014-7816","published":"2014-12-01","fixed":"1.2.0.Beta3","kev":false},{"cve":"CVE-2017-2670","published":"2018-07-27","fixed":"1.3.28","kev":false,"link":{"from":"CVE-2017-2670","to":"CVE-2017-2666","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.3.28","toFixed":"1.3.31","daysApart":0}]}},{"cve":"CVE-2016-7046","published":"2016-10-03","fixed":"1.4.3.Final","kev":false,"link":{"from":"CVE-2016-7046","to":"CVE-2017-2666","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.4.3.Final","toFixed":"1.4.17","daysApart":662}]}},{"cve":"CVE-2017-2666","published":"2018-07-27","fixed":"1.4.17","kev":false},{"cve":"CVE-2017-7559","published":"2018-01-10","fixed":"2.0.0.Alpha2","kev":false},{"cve":"CVE-2017-12165","published":"2018-07-27","fixed":"2.0.0.Beta1","kev":false},{"cve":"CVE-2017-12196","published":"2018-04-18","fixed":"2.0.2.FInal","kev":false}],"package":"Maven:io.undertow:undertow-core"}}