CVE-2017-12165 Undertow Request Smuggling vulnerability

What is CVE-2017-12165?

CVE-2017-12165 is a low-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 27 Jul 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Weakness: CWE-444

Which versions are affected by CVE-2017-12165?

6 open source packages ship an affected version, including io.undertow:undertow-core. It affects 2 products.

Products include Redhat Jboss Enterprise Application Platform, Redhat Undertow.

How do I fix CVE-2017-12165?

Upgrade io.undertow:undertow-core to a fixed version for your release line: 1.3.31, 1.4.17 or 2.0.0.Beta1.

Is CVE-2017-12165 being exploited?

There is no known exploitation of CVE-2017-12165 in the wild and no public exploit code.

Other vulnerabilities in Redhat Jboss Enterprise Application Platform

• CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution Exploited Critical 9.8
• CVE-2010-1428 Red Hat JBoss Information Disclosure Exploited Medium 5.9
• CVE-2010-0738 Red Hat JBoss Authentication Bypass Exploited Low 3.7
• CVE-2016-3690 Deserialization in n/a Critical 9.8
• CVE-2017-7504 Deserialization in JBoss Critical 9.8

All Redhat Jboss Enterprise Application Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-12165, GHSA-5gg7-5wv8-4gcj, UBUNTU-CVE-2017-12165.