GHSA-gpch-h32j-gx6x

Source

https://github.com/advisories/GHSA-gpch-h32j-gx6x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-gpch-h32j-gx6x/GHSA-gpch-h32j-gx6x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gpch-h32j-gx6x

Aliases

CVE-2020-5404

Published

2022-02-10T20:24:17Z

Modified

2023-11-08T04:03:55.102290Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Insufficiently Protected Credentials in Reactor Netty

Details

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

Database specific

{
    "cwe_ids": [
        "CWE-522"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2020-03-03T18:15:00Z",
    "github_reviewed_at": "2021-04-22T20:23:58Z"
}

References

Affected packages

Maven / io.projectreactor.netty:reactor-netty-http

Package

Name: io.projectreactor.netty:reactor-netty-http; View open source insights on deps.dev
Purl: pkg:maven/io.projectreactor.netty/reactor-netty-http

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.9.0

Fixed

0.9.5

Maven / io.projectreactor.netty:reactor-netty-http

Package

Name: io.projectreactor.netty:reactor-netty-http; View open source insights on deps.dev
Purl: pkg:maven/io.projectreactor.netty/reactor-netty-http

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.8.0

Fixed

0.8.16