LiveUpdate Administrator/Endpoint Protection manager affected by CVE-2023-46589?

Products

• Endpoint Protection

Issue/Introduction

Is LiveUpdate Administrator (LUA)/Symantec Endpoint Protection Manager (SEPM) affected by CVE-2023-46589?

Resolution

LUA is not impacted. LUA does not utilize HTTP trailer headers so no impact.

 

SEPM is not impacted. SEPM Tomcat is unaffected because the HTTP trailer header needs to be configured with the allowedTrailerHeaders directive, but it's not specified thus defaulting to false.