CVE-2018-1048: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser

Related Vulnerabilities: CVE-2018-1048  

Debian Bug report logs - #891928
CVE-2018-1048: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser

version graph

Reported by: Markus Koschany <apo@debian.org>

Date: Fri, 2 Mar 2018 17:45:01 UTC

Severity: grave

Tags: security

Found in versions undertow/1.4.8-1, undertow/1.4.8-1+deb9u1

Fixed in version undertow/1.4.22-1

Done: Markus Koschany <apo@debian.org>

Bug is archived. No further changes may be made.

Forwarded to https://issues.jboss.org/browse/UNDERTOW-1245

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, apo@debian.org, team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>:
Bug#891928; Package src:undertow. (Fri, 02 Mar 2018 17:45:04 GMT) (full text, mbox, link).


Acknowledgement sent to Markus Koschany <apo@debian.org>:
New Bug report received and forwarded. Copy sent to apo@debian.org, team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>. (Fri, 02 Mar 2018 17:45:04 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2018-1048: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser
Date: Fri, 02 Mar 2018 18:42:14 +0100
Source: undertow
Version: 1.4.8-1+deb9u1
Severity: grave
Tags: security
Forwarded: https://issues.jboss.org/browse/UNDERTOW-1245

It was found that the AJP connector in undertow, as shipped in Jboss
EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus
allow the the slash / anti-slash characters encoded in the url which
may lead to path traversal and result in the information disclosure of
arbitrary local files.

Upstream bug:

https://issues.jboss.org/browse/UNDERTOW-1245

This was apparently fixed in 1.4.22.



Marked as found in versions undertow/1.4.8-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 02 Mar 2018 18:12:18 GMT) (full text, mbox, link).


Marked as fixed in versions undertow/1.4.22-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 02 Mar 2018 18:12:19 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>:
Bug#891928; Package src:undertow. (Sat, 03 Mar 2018 14:03:03 GMT) (full text, mbox, link).


Acknowledgement sent to Markus Koschany <apo@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>. (Sat, 03 Mar 2018 14:03:03 GMT) (full text, mbox, link).


Message #14 received at 891928@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: 891928@bugs.debian.org
Subject: Re: CVE-2018-1048: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser
Date: Sat, 3 Mar 2018 15:02:24 +0100
[Message part 1 (text/plain, inline)]
Link to patch:

https://github.com/undertow-io/undertow/commit/1bc0c275aadf5835abfbd3835d5d78095c2f1cf5

[signature.asc (application/pgp-signature, attachment)]

Reply sent to Markus Koschany <apo@debian.org>:
You have taken responsibility. (Sun, 06 May 2018 19:39:05 GMT) (full text, mbox, link).


Notification sent to Markus Koschany <apo@debian.org>:
Bug acknowledged by developer. (Sun, 06 May 2018 19:39:05 GMT) (full text, mbox, link).


Message #19 received at 891928-done@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: 891928-done@bugs.debian.org
Subject: Re: CVE-2018-1048: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser
Date: Sun, 6 May 2018 21:38:09 +0200
[Message part 1 (text/plain, inline)]
I am going to close this bug report because CVE-2018-1048 will not be
fixed in Stretch. As discussed with the security team the package will
be removed instead.

[signature.asc (application/pgp-signature, attachment)]

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 15 Jul 2018 07:27:36 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 13:54:16 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.