Search for vulnerabilities
Vulnerability details: VCID-mqhb-fgt3-aaaa
Vulnerability ID VCID-mqhb-fgt3-aaaa
Aliases CVE-2018-1067
GHSA-47mp-rq2x-wjf2
Summary HTTP Response Splitting Undertow is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2018:1247
rhas Important https://access.redhat.com/errata/RHSA-2018:1248
rhas Important https://access.redhat.com/errata/RHSA-2018:1249
rhas Important https://access.redhat.com/errata/RHSA-2018:1251
rhas Important https://access.redhat.com/errata/RHSA-2018:2643
rhas Important https://access.redhat.com/errata/RHSA-2019:0877
rhas Important https://access.redhat.com/errata/RHSA-2020:2562
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1067.json
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00288 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00299 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00622 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
epss 0.00711 https://api.first.org/data/v1/epss?cve=CVE-2018-1067
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1550671
cvssv3.1 6.1 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-47mp-rq2x-wjf2
cvssv2 5.8 https://nvd.nist.gov/vuln/detail/CVE-2018-1067
cvssv3 6.1 https://nvd.nist.gov/vuln/detail/CVE-2018-1067
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2018-1067
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1067.json
https://api.first.org/data/v1/epss?cve=CVE-2018-1067
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067
https://github.com/undertow-io/undertow/commit/85d4478e598105fe94ac152d3e11e388374e8b8
https://github.com/undertow-io/undertow/commit/f404cb68448c188f4d51b085b7fe4ac32bde26e
1550671 https://bugzilla.redhat.com/show_bug.cgi?id=1550671
900323 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900323
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
CVE-2018-1067 https://nvd.nist.gov/vuln/detail/CVE-2018-1067
GHSA-47mp-rq2x-wjf2 https://github.com/advisories/GHSA-47mp-rq2x-wjf2
RHSA-2018:1247 https://access.redhat.com/errata/RHSA-2018:1247
RHSA-2018:1248 https://access.redhat.com/errata/RHSA-2018:1248
RHSA-2018:1249 https://access.redhat.com/errata/RHSA-2018:1249
RHSA-2018:1251 https://access.redhat.com/errata/RHSA-2018:1251
RHSA-2018:2643 https://access.redhat.com/errata/RHSA-2018:2643
RHSA-2019:0877 https://access.redhat.com/errata/RHSA-2019:0877
RHSA-2020:2562 https://access.redhat.com/errata/RHSA-2020:2562
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-1067.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-1067
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-1067
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-1067
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.58916
EPSS Score 0.00206
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.