CVE-2018-14642

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Red Hat	undertow	n/a

References

https://access.redhat.com/errata/RHSA-2019:0362Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0364Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0365Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0380Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1106Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1107Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1108Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1140Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14642Issue Tracking, Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0362Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0364Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0365Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0380Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1106Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1107Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1108Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1140Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14642Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Sep 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146439.8An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remo CVE-2018-146445.9An issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote attacker sending a DNS query for a meta-type lik CVE-2018-146457.5A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_i CVE-2018-146465.5The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the CVE-2018-146477.5Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial o CVE-2018-146487.5A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() functi CVE-2018-146499.8It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is don CVE-2018-14655.3IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,CVE-2018-146505.0It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the t CVE-2018-146518.8It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, a CVE-2018-146526.5The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/index' translator via the code h CVE-2018-146538.8The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '__server_getspec' function via