CVE-2023-4639

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-4639

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4639.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-4639

Aliases

GHSA-3jrv-jgp8-45v3

Related

Published

2024-11-17T11:15:05Z

Modified

2025-01-09T04:47:28.526286Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

References

Affected packages

Debian:13 / undertow

Package

Name: undertow
Purl: pkg:deb/debian/undertow?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.18-1

Affected versions

1.*

1.3.4-1

1.3.5-1

1.3.7-1

1.3.11-1

1.3.16-1

1.3.19-1

1.3.21-1

1.3.23-1

1.4.0-1

1.4.1-1

1.4.3-1

1.4.4-1

1.4.6-1

1.4.7-1

1.4.8-1

1.4.18-1

1.4.20-1

1.4.21-1

1.4.21-2

1.4.22-1

1.4.23-1

1.4.23-2

1.4.23-3

1.4.25-1

1.4.25-2

2.*

2.0.23-1

2.0.25-1

2.0.26-1

2.0.27-1

2.0.28-1

2.0.29-1

2.0.30-1

2.1.0-1

2.1.1-1

2.1.3-1

2.2.0-1

2.2.2-1

2.2.3-1

2.2.4-1

2.2.5-1

2.2.8-1

2.2.10-1

2.2.12-1

2.2.13-1

2.2.14-1

2.2.16-1

2.2.17-1

2.2.18-1

2.2.19-1

2.2.20-1

2.2.21-1

2.3.8-1

2.3.8-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}