5.9med
CVE-2016-7046
Undertow Uncaught Exception vulnerability
Also known as GHSA-3f57-w2rp-72fc
Published 10 y ago · modified 4 mo ago · JSON
CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 85%
Public exploits
0
none known
Summary
Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.
Exploit prediction (EPSS)
2.48% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 7.1 | AV:N/AC:M/Au:N/C:N/I:N/A:C |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-core | >=1.4.0, <1.4.3.Final <1.3.25.Final | 1.4.3.Final 1.3.25.Final |
Classification
References
- rhn.redhat.com /errata/RHSA-2016-2640.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:3458 · vendor-advisory, x_refsource_REDHAT, x_transferred
- rhn.redhat.com /errata/RHSA-2016-2642.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:3455 · vendor-advisory, x_refsource_REDHAT, x_transferred
- rhn.redhat.com /errata/RHSA-2016-2657.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2017:3456 · vendor-advisory, x_refsource_REDHAT, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=1376646 · x_refsource_CONFIRM, x_transferred
- access.redhat.com /errata/RHSA-2017:3454 · vendor-advisory, x_refsource_REDHAT, x_transferred
- rhn.redhat.com /errata/RHSA-2016-2641.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/93173 · vdb-entry, x_refsource_BID, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-7046 · advisory
- github.com /undertow-io/undertow/commit/c518b5a1784061d807efedcef0a03fcd35a53de2 · web
- github.com /undertow-io/undertow · package
- issues.redhat.com /browse/UNDERTOW-835 · web
- security-tracker.debian.org /tracker/CVE-2016-7046 · web
Sources
- CVE List: CVE-2016-7046
- GitHub Advisory: GHSA-3f57-w2rp-72fc
- NVD: CVE-2016-7046
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.