CVE-2016-4993 Vulnerability in maven package io.undertow:undertow-core

Description

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2016-1838.html

http://rhn.redhat.com/errata/RHSA-2016-1839.html

http://rhn.redhat.com/errata/RHSA-2016-1840.html

http://rhn.redhat.com/errata/RHSA-2016-1841.html

http://www.securityfocus.com/bid/92894

http://www.securitytracker.com/id/1036758

https://access.redhat.com/errata/RHSA-2017:3454

https://access.redhat.com/errata/RHSA-2017:3455

https://access.redhat.com/errata/RHSA-2017:3456

https://access.redhat.com/errata/RHSA-2017:3458

https://bugzilla.redhat.com/show_bug.cgi?id=1344321

Related Vulnerabilities

CVE-2020-2198 Vulnerability in maven package hudson.plugins:project-inheritance

CVE-2021-43306 Vulnerability in maven package org.webjars:jquery-validation

CVE-2020-7679 Vulnerability in npm package casperjs

CVE-2018-20094 Vulnerability in maven package com.xuxueli:xxl-conf

CVE-2010-5312 Vulnerability in npm package jquery-ui

Severity

High

Classification

CWE-93 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N