5.3

CVE-2018-12537

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eclipse ≫ Vert.X Version >= 3.0.0 <= 3.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.48% 0.825
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

https://access.redhat.com/errata/RHSA-2018:3768
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2371
Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038
Third Party Advisory
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1591072
Third Party Advisory
Issue Tracking
https://github.com/eclipse/vert.x/commit/1bb6445226c39a95e7d07ce3caaf56828e8aab72
Third Party Advisory
https://github.com/eclipse/vert.x/issues/2470
Third Party Advisory
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txt
Third Party Advisory