This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-10687 →
DEBIAN-CVE-2020-10687
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible again...
Original description
The description as published by the source.
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:14
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1"}]}]
References
- advisory security-tracker.debian.org