CVE-2017-12165

Debian Bug report logs - #885338
CVE-2017-12165

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2017-12165

Date: Tue, 26 Dec 2017 13:42:37 +0100

Source: undertow
Severity: important
Tags: security

The only source here is a report in Red Hat Bugzilla, so might be worth contacting
upstream for additional information:
https://bugzilla.redhat.com/show_bug.cgi?id=1490301

Cheers,
        Moritz

Message #10 received at 885338@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 885338@bugs.debian.org

Cc: 885576@bugs.debian.org

Subject: Re: undertow: CVE-2017-7559: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)

Date: Thu, 28 Dec 2017 18:55:54 +0100

[Message part 1 (text/plain, inline)]

On Thu, 28 Dec 2017 09:55:12 +0100 Salvatore Bonaccorso
<carnil@debian.org> wrote:
> Source: undertow
> Severity: important
> Tags: security
> 
> Hi,
> 
> the following vulnerability was published for undertow.
> 
> There is not much information available if that incomplete fix affects
> us as well. Or which this was fixed upstream. I asked for
> clarification in [1], but might you contact directly as well upstream
> about that?

Hi,

I requested more information about the fix for CVE-2017-12165 in Red
Hat's bug tracker. I couldn't find a recent fixing commit in the
upstream Git repository.

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 885338@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: 885338@bugs.debian.org

Subject: Re: undertow: CVE-2017-7559: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)

Date: Fri, 2 Mar 2018 19:09:10 +0100

[Message part 1 (text/plain, inline)]

Control: forwarded -1 https://issues.jboss.org/browse/UNDERTOW-1251

It seems this issue is tracked at

https://issues.jboss.org/browse/UNDERTOW-1251

However the bug report appears to be a duplicate of UNDERTOW-1101 which
was CVE-2017-2666 last year. I added a comment and hope that someone can
clarify the situation.

[signature.asc (application/pgp-signature, attachment)]

Message #22 received at 885338@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Markus Koschany <apo@debian.org>, 885338@bugs.debian.org

Subject: Re: Bug#885338: undertow: CVE-2017-7559: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)

Date: Tue, 8 May 2018 08:44:03 +0200

Hi

On Fri, Mar 02, 2018 at 07:09:10PM +0100, Markus Koschany wrote:
> Control: forwarded -1 https://issues.jboss.org/browse/UNDERTOW-1251
> 
> It seems this issue is tracked at
> 
> https://issues.jboss.org/browse/UNDERTOW-1251
> 
> However the bug report appears to be a duplicate of UNDERTOW-1101 which
> was CVE-2017-2666 last year. I added a comment and hope that someone can
> clarify the situation.

Whoops I missed you followuped as well here. I added the following comment, but
it's unverified that my claim is true:

> [...]
> Regarding the CVE-2017-12165 the distinction
> to CVE-2017-7559 is the following, as far I'm parsing the available
> invoformation.
> 
> undertow: HTTP Request smuggling vulnerability (incomplete fix of
> CVE-2017-2666) (CVE-2017-7559)
> 
> Then OTOH CVE-2017-12165 is
> 
> undertow: improper whitespace parsing leading to potential HTTP
> request smuggling (CVE-2017-12165)
> 
> so it's in the same class of issues, I have the slight suspect that
> the fix for CVE-2017-7559 (the incomplete fix for CVE-2017-2666
> fix/commit) includes as well a fix for the "improper whitespace
> parsing", but I cannot say for sure. The commit at least adds several
> tests for "testTabInsteadOfSpaceAfterVerb" and whiespaces.
> 
> https://github.com/undertow-io/undertow/commit/3436b03eda8b0b62c1855698c4d7c358add836c2

Regards,
Salvatore

Send a report that this bug log contains spam.