Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-20220 →
DEBIAN-CVE-2021-20220
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible agains...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:14
undertow
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-1"}]}]
Références
- advisory security-tracker.debian.org