Skip to content
fr Sign in
7.4 High

CVE-2023-4639 A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming…

Description

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Affected products and versions

Product Affected versions Fixed in
Migration Toolkit for Runtimes 1 on RHEL 8 1.2 earliest → < 1.2-14 1.2-14
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Versions not published
Migration Toolkit for Applications 6 Versions not published
Show the 15 other branches
Product Affected versions Fixed in
Red Hat build of Apache Camel for Spring Boot 3 Versions not published
Red Hat build of Apicurio Registry Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Decision Manager 7 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Integration Camel K Versions not published
Red Hat Integration Camel Quarkus Versions not published
Red Hat Integration Change Data Capture Versions not published
Red Hat JBoss Data Grid 7 Versions not published
Red Hat JBoss Enterprise Application Platform 6 Versions not published
Red Hat JBoss Fuse 6 Versions not published
Red Hat JBoss Fuse Service Works 6 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Single Sign-On 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Migration Toolkit for Runtimes 1 on RHEL 8

The 3 CVEs of Migration Toolkit for Runtimes 1 on RHEL 8 →
CVE-2024-1132 Keycloak: path transversal in redirection validation 8.1 High CVE-2024-1300 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support 5.4 Medium
Track this CVE