Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Summary

A flaw was discovered in Red Hat JBoss EAP 6.4.21, where it does not process the header field-name in accordance with RFC7230. Whitespace between the header field-name and colon is processed, resulting in an HTTP response code of 200 instead of a bad request of 400. Fixed versions, Red Hat JBoss EAP 7.2.9, Red Hat JBoss EAP 7.3.2, Red Hat JBoss EAP 7.2.9 on RHEL 6, Red Hat JBoss EAP 7.3.2 on RHEL 6, Red Hat JBoss EAP 7.2.9 on RHEL 7, Red Hat JBoss EAP 7.3.2 on RHEL 7, Red Hat JBoss EAP 7.2.9 on RHEL 8, Red Hat JBoss EAP 7.3.2 on RHEL 8, Red Hat Single Sign-On 7.4.2, Red Hat build of Thorntail 2.7.1, and Red Hat Data Grid 7.3.7.