Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zanJ2LWpncDgtNDV2M84ABBcA

Undertow incorrectly parses cookies

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Permalink: https://github.com/advisories/GHSA-3jrv-jgp8-45v3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zanJ2LWpncDgtNDV2M84ABBcA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 days ago
Updated: 2 days ago

CVSS Score: 7.4
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-3jrv-jgp8-45v3, CVE-2023-4639
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-4639
• https://access.redhat.com/errata/RHSA-2024:1674
• https://access.redhat.com/errata/RHSA-2024:1675
• https://access.redhat.com/errata/RHSA-2024:1676
• https://access.redhat.com/errata/RHSA-2024:1677
• https://access.redhat.com/errata/RHSA-2024:2763
• https://access.redhat.com/errata/RHSA-2024:2764
• https://access.redhat.com/errata/RHSA-2024:3919
• https://access.redhat.com/security/cve/CVE-2023-4639
• https://bugzilla.redhat.com/show_bug.cgi?id=2166022
• https://github.com/undertow-io/undertow/commit/1f93a979d2ac264798e5779b5b7172dfafe0066f
• https://github.com/advisories/GHSA-3jrv-jgp8-45v3

Repository: https://github.com/undertow-io/undertow
Blast Radius: 27.5

Affected Packages