CVE-2017-12196
Summary
| CVE | CVE-2017-12196 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-04-18 01:29:00 UTC |
| Updated | 2019-10-09 23:22:00 UTC |
| Description | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server. |
Risk And Classification
Problem Types: CWE-863
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Redhat | Jboss Enterprise Application Platform | 7.0.0 | All | All | All |
| Application | Redhat | Jboss Enterprise Application Platform | 7.0.0 | All | All | All |
| Application | Redhat | Jboss Fuse | 6.0.0 | All | All | All |
| Application | Redhat | Jboss Fuse | 6.0.0 | All | All | All |
| Application | Redhat | Undertow | 1.4.24 | All | All | All |
| Application | Redhat | Undertow | 2.0.2 | All | All | All |
| Application | Redhat | Undertow | 1.4.24 | All | All | All |
| Application | Redhat | Undertow | 2.0.2 | All | All | All |
| Application | Redhat | Undertow | All | All | All | All |
| Application | Redhat | Virtualization | 4.0 | All | All | All |
| Application | Redhat | Virtualization | 4.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [UNDERTOW-1190] client can use bogus uri in digest authentication - Red Hat Issue Tracker | CONFIRM | issues.jboss.org | Issue Tracking |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Vendor Advisory |
| 1503055 – (CVE-2017-12196) CVE-2017-12196 undertow: Client can use bogus uri in Digest authentication | CONFIRM | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.