Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12ZjZyLW1taGMtM3hjbc3z1g

Exposure of Sensitive Information to an Unauthorized Actor in Undertow

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.

Permalink: https://github.com/advisories/GHSA-vf6r-mmhc-3xcm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12ZjZyLW1taGMtM3hjbc3z1g
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Percentage: 0.00316
EPSS Percentile: 0.70697

Identifiers: GHSA-vf6r-mmhc-3xcm, CVE-2018-14642
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-14642
• https://access.redhat.com/errata/RHSA-2019:0362
• https://access.redhat.com/errata/RHSA-2019:0364
• https://access.redhat.com/errata/RHSA-2019:0365
• https://access.redhat.com/errata/RHSA-2019:0380
• https://access.redhat.com/errata/RHSA-2019:1106
• https://access.redhat.com/errata/RHSA-2019:1107
• https://access.redhat.com/errata/RHSA-2019:1108
• https://access.redhat.com/errata/RHSA-2019:1140
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14642
• https://github.com/advisories/GHSA-vf6r-mmhc-3xcm

Blast Radius: 19.7

Affected Packages