This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-20220 →
DEBIAN-CVE-2021-20220
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible agains...
Original description
The description as published by the source.
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:14
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1"}]}]
References
- advisory security-tracker.debian.org