CVE-2018-1067

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

References

Affected packages

Git / github.com/qos-ch/slf4j

Affected ranges

Type: GIT
Repo: https://github.com/qos-ch/slf4j
Events: Introduced

0614d467d7bca81724f45e228f4f871161222b51

Fixed

7e62e1e6917e19e6eeb8faf97daa9e2469bc946d

Affected versions

v_2.*

v_2.0.0

v_2.0.1

v_2.0.2

v_2.0.3

v_2.0.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1067.json"

Git / github.com/undertow-io/undertow

Affected ranges

Type: GIT
Repo: https://github.com/undertow-io/undertow
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

5d57f1321e86209a30626e6a35d9cf9a063766fc

Introduced

e7bff13d8cc5928963399bb939026da0c6b7f0cf

Fixed

215abe439ae9237da41ea4a1dc0c272a41c84ba8

Affected versions

2.*

2.0.0.Final

2.0.1.Final

2.0.2.Final

2.0.3.Final

2.0.4.Final

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1067.json"