{"id":"CVE-2021-20220","published":"2021-02-23T17:21:44Z","modified":"2024-08-03T17:30:07Z","title":"A flaw was found in Undertow","vendor":null,"product":null,"tier":"tail","description":{"text":"A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.012,"percentile":0.68154,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1923133","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220210-0013/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.6,"factors":[{"name":"EPSS percentile","points":13.63}]},"affectedVersions":[{"vendor":"n/a","product":"undertow","versions":["Undertow 2.2.0.Final, Undertow 2.1.6.Final, Undertow 2.0.34.Final"]}],"affected":[{"ecosystem":"Maven","package":"io.undertow:undertow-core","vulnerableRanges":[">=2.1.0, <2.1.6","<2.0.34"],"patched":["2.1.6","2.0.34"],"from":["GHSA-qjwc-v72v-fq6r"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1382","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-undertow-cve-2016-4993","parents":[{"from":"CVE-2020-10687","to":"CVE-2021-20220","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"A regression in the fix for CVE-2020-10687 was found.","from":"CVE.org","in":"CVE-2021-20220"},{"kind":"similar","provenance":"machine","score":0.81,"basis":"same package + description similarity"}]},{"from":"CVE-2017-12165","to":"CVE-2021-20220","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["core/src/main/java/io/undertow/server/Connectors.java","core/src/main/java/io/undertow/server/protocol/http/HttpRequestParser.java","core/src/main/java/io/undertow/server/protocol/http2/Http2ReceiveListener.java"],"commits":["https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f","https://github.com/undertow-io/undertow/commit/9e797b2f99617fdad0471eaa88c711ee7f44605f"],"basis":"shared function","functions":["HttpRequestParser","handleRequests"]}]},{"from":"CVE-2017-2666","to":"CVE-2021-20220","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request.","from":"CVE.org","in":"CVE-2021-20220"},{"kind":"similar","provenance":"machine","score":0.44,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2020-10705","published":"2020-06-10","fixed":"2.1.1.Final","kev":false},{"cve":"CVE-2020-10719","published":"2020-05-26","fixed":"2.1.1.Final","kev":false},{"cve":"CVE-2020-27782","published":"2021-02-23","fixed":"2.1.5","kev":false,"link":{"from":"CVE-2020-27782","to":"CVE-2021-20220","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"2.1.5","toFixed":"2.1.6","daysApart":0}]}},{"cve":"CVE-2021-20220","published":"2021-02-23","fixed":"2.1.6","kev":false},{"cve":"CVE-2020-10687","published":"2020-09-23","fixed":"2.2.0.Final","kev":false},{"cve":"CVE-2021-3597","published":"2022-05-24","fixed":"2.2.9.Final","kev":false,"link":{"from":"CVE-2021-20220","to":"CVE-2021-3597","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"2.0.34","toFixed":"2.0.39.Final","daysApart":455}]}},{"cve":"CVE-2021-3690","published":"2022-08-23","fixed":"2.2.10","kev":false}],"package":"Maven:io.undertow:undertow-core"}}