{"id":"CVE-2017-12165","published":"2018-07-27T15:00:00Z","modified":"2024-08-05T18:28:16Z","title":"It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual…","vendor":"Red Hat","product":"undertow","tier":"tail","description":{"text":"It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.","provenance":"source","from":"CVE.org"},"cvss":{"score":2.6,"severity":"LOW","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01858,"percentile":0.79216,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1322","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0002","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3458","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0004","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3455","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3456","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0003","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0005","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3454","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":15.84},{"name":"CVSS severity","points":1.82}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"undertow","versions":["1.4.17","1.3.31","2.0.0"]}],"affected":[{"ecosystem":"Maven","package":"io.undertow:undertow-core","vulnerableRanges":["<1.3.31",">=1.4.0, <1.4.17",">=2.0.0.Alpha1, <2.0.0.Beta1"],"patched":["1.3.31","1.4.17","2.0.0.Beta1"],"from":["GHSA-5gg7-5wv8-4gcj"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2579","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-2670","published":"2018-07-27","fixed":"1.3.28","kev":false,"link":{"from":"CVE-2017-2670","to":"CVE-2017-12165","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.3.28","toFixed":"1.3.31","daysApart":0}]}},{"cve":"CVE-2016-7046","published":"2016-10-03","fixed":"1.4.3.Final","kev":false,"link":{"from":"CVE-2016-7046","to":"CVE-2017-12165","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"1.4.3.Final","toFixed":"1.4.17","daysApart":662}]}},{"cve":"CVE-2017-2666","published":"2018-07-27","fixed":"1.4.17","kev":false},{"cve":"CVE-2017-7559","published":"2018-01-10","fixed":"2.0.0.Alpha2","kev":false,"link":{"from":"CVE-2017-7559","to":"CVE-2017-12165","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.undertow:undertow-core","fromFixed":"2.0.0.Alpha2","toFixed":"2.0.0.Beta1","daysApart":198}]}},{"cve":"CVE-2017-12165","published":"2018-07-27","fixed":"2.0.0.Beta1","kev":false},{"cve":"CVE-2017-12196","published":"2018-04-18","fixed":"2.0.2.FInal","kev":false},{"cve":"CVE-2018-1114","published":"2018-09-11","fixed":"2.0.5.Final","kev":false},{"cve":"CVE-2018-14642","published":"2018-09-18","fixed":"2.0.19.FINAL","kev":false}],"package":"Maven:io.undertow:undertow-core"}}