← back
CVE-2017-12165lowCWE-444

CVE-2017-12165

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.6epss 1.9%
exploitation probability
1.9%top 22% of all CVEs
observed exploitation
nono source reports it
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected products
Red Hat · undertow
References
https://access.redhat.com/errata/RHSA-2017:3454https://access.redhat.com/errata/RHSA-2017:3455https://access.redhat.com/errata/RHSA-2017:3456https://access.redhat.com/errata/RHSA-2017:3458https://access.redhat.com/errata/RHSA-2018:0002https://access.redhat.com/errata/RHSA-2018:0003https://access.redhat.com/errata/RHSA-2018:0004https://access.redhat.com/errata/RHSA-2018:0005https://access.redhat.com/errata/RHSA-2018:1322https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165