Moderate severity vulnerability that affects io.vertx:vertx-core
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-12537US | medium5.3 | Exploit | ||
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value.… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2018:2371WEB
- https://access.redhat.com/errata/RHSA-2018:3768WEB
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1591072WEB
- https://github.com/advisories/GHSA-6cw8-7j6c-hccpADVISORY
- https://github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72WEB
- https://github.com/eclipse/vert.x/issues/2470WEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-12537ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan