Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-10687 →
DEBIAN-CVE-2020-10687
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible again...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:14
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1"}]}]
Références
- advisory security-tracker.debian.org