VulnerabilityModified

CVE-2018-12537

This allow unfiltered values to inject a new header in the client request or server response.

MEDIUM 5.3EPSS 2.48%

Does this matter?

Lower severity and a low EPSS score (2.48%). Track it; it rarely justifies an emergency change on its own.

Description

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.

CVSS 3.0: 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 2.48% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-93, CWE-20
Affected: eclipse/vert.x
Source: emo@eclipse.org

References

https://access.redhat.com/errata/RHSA-2018:2371Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3768Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1591072Issue Tracking, Third Party Advisory
https://github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72Third Party Advisory
https://github.com/eclipse/vert.x/issues/2470Third Party Advisory
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txtThird Party Advisory
https://access.redhat.com/errata/RHSA-2018:2371Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3768Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1591072Issue Tracking, Third Party Advisory
https://github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72Third Party Advisory
https://github.com/eclipse/vert.x/issues/2470Third Party Advisory
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txtThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.