Log in Start free

Vulnerability · Published Nov 17, 2024 · Assigned by redhat

CVE-2023-4639Undertow: cookie smuggling/spoofing

High 7.4

In plain English

A high-severity security flaw in Migration Toolkit for Applications 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)1.1%top 34.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13undertow2.3.18-1CVE-2023-4639
Debian:14undertow2.3.18-1DEBIAN-CVE-2023-4639
Mavenio.undertow:undertow-core2.2.30.FinalGHSA-3jrv-jgp8-45v3
Mavenio.undertow:undertow-core2.3.11.FinalGHSA-3jrv-jgp8-45v3
Ubuntu:25.10undertowno fix listedUBUNTU-CVE-2023-4639
Ubuntu:26.04:LTSundertowno fix listedUBUNTU-CVE-2023-4639
Ubuntu:26.10undertowno fix listedUBUNTU-CVE-2023-4639

Affected products (as reported)

VendorProductVersions
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 see references
Red Hat Migration Toolkit for Applications 6 see references
Red Hat Red Hat build of Apache Camel for Spring Boot 3 see references
Red Hat Red Hat build of Apicurio Registry see references
Red Hat Red Hat build of Quarkus see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Decision Manager 7 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat Integration Camel K see references
Red Hat Red Hat Integration Camel Quarkus see references
Red Hat Red Hat Integration Change Data Capture see references
Red Hat Red Hat JBoss Data Grid 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 6 see references
Red Hat Red Hat JBoss Fuse 6 see references
Red Hat Red Hat JBoss Fuse Service Works 6 see references
Red Hat Red Hat Process Automation 7 see references
Red Hat Red Hat Single Sign-On 7 see references

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References