Description
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | undertow 1.4.18.SP1, undertow 2.0.2.Final, undertow 1.4.24.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 1.4.25-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | rhvm-appliance | 2:4.2-20180504.0.el7 | RHSA-2018:1525 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 1.5.5.009-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.1.13-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.2.13-6.SP5_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.1.12-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-infinispan +5 | 8.2.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jackson-core +9 | 2.8.11-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.1.1-3.1.GA_redhat_3.ep7.el6 | RHSA-2018:0481 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.0.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +18 | 1.0.3-6.Final_redhat_6.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.1.10-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.5.31-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-10.SP9_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-resteasy +16 | 3.0.25-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.4.18-4.SP2_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.1.1-4.GA_redhat_2.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.1.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.1.1-3.GA_redhat_2.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.1.11-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.0.9-1.redhat_1.1.ep7.el6 | RHSA-2018:0480, RHSA-2018:0479 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | >= 2.0.0.Alpha1, < 2.0.2.FInal | 2.0.2.FInal | GHSA-cp7v-vmv7-6x2q |
| Maven | io.undertow:undertow-core | < 1.4.24.Final | 1.4.24.Final | GHSA-cp7v-vmv7-6x2q |
Advisories 5
- WID-SEC-2026-2753 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2018:1525 Red Hat Security Advisory: rhvm-appliance security and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:0481 Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.1 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0479 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0480 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 for RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- RHSA-2018:0479 vendor-advisory
- RHSA-2018:0481 vendor-advisory
- RHSA-2018:2405 vendor-advisory
- RHSA-2018:1525 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196
- RHSA-2018:0480 vendor-advisory
- https://issues.jboss.org/browse/UNDERTOW-1190
- RHSA-2018:3768 vendor-advisory
- RHSA-2018:0478 vendor-advisory