Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTkzanEtNjI0Zy00cDlw
Improper Input Validation in async-http-client
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Permalink: https://github.com/advisories/GHSA-93jq-624g-4p9pJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTkzanEtNjI0Zy00cDlw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 6 years ago
Updated: almost 2 years ago
CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Identifiers: GHSA-93jq-624g-4p9p, CVE-2017-14063
References:
- https://nvd.nist.gov/vuln/detail/CVE-2017-14063
- https://github.com/AsyncHttpClient/async-http-client/issues/1455
- https://access.redhat.com/errata/RHSA-2018:2669
- https://github.com/advisories/GHSA-93jq-624g-4p9p
- https://lists.apache.org/thread.html/r04b15fd898a6b1612153543375daaa8145a0fd1804ec9fa2e0d95c97@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r0a6b6429a7558051dbb70bd06584b4b1c334a80ec9203d3d39b7045a@%3Ccommits.tez.apache.org%3E
- https://lists.apache.org/thread.html/r14a74d204f285dd3a4fa203de6dbb4e741ddb7fdfff7915590e5b3db@%3Cdev.tez.apache.org%3E
- https://lists.apache.org/thread.html/r3df4b7ccc363b4850a24842138117aa4451b875bc4773a845b828fc6@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r41a0e2c36f7d1854a4d56cb1e4aa720ef501782d887ece1c9b1e2d60@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r4ebb9596d890f3528630492bd78237b3eef06f093bac238a0da9b630@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r5b8666c4414500ff6e993bfa69cb6afa19b1b67c4585a045c0c21662@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r5f07c30721503d4c02d5451f77a611a1a0bb2a94ddcdf071c9485ea3@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r5f794dc07913c5f2ec08f540813b40e61b562d36f8b1f916e8705c56@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r683d78c6d7a15659f2bb82dd4120dab8c45a870eaa7f1a15cce4ed3b@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r7046a51116207588e36ca8c2e291327e391dae40712d267117475a98@%3Cdev.tez.apache.org%3E
- https://lists.apache.org/thread.html/r7879a48644f708be0529bd39f0679ad3ad951f3dc24442878a008fd8@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r79d9bab405414af45568c4683386f5e9fd02c10ca87ffa2ee33512dc@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r868875e67494a18d31e88cba2672f45c3fc6708ffdde445723004da4@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/r9ea5d489e004b40baf73880c4e11dd4de24b799d15e091e1f4017108@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/rbbad61e1ba5b21e234a6664963618acfee237af754eb20300d938e1e@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/rbc4fbb06ccb10e26e6064f57f6bd4935eabe2d18a0cb9a7183699396@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/rc550b8955b37b40fee18db99f167337c41c930d8c3763b9631e01dda@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/rcb46acc25917e01ebecca132e870da9ab935d5796686ed8a2785b026@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/re2510852c4a1f635b14b35e5dfd7597076928e723ab08559ede575e0@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/re7367895ccbf64523efcd39a9181baf2eaa30b069d8d6496852fba56@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rfd823a733b02cffbef5a69953fdcbed2d1d0afad5e1ea4e96ff6bf0a@%3Cissues.tez.apache.org%3E
- https://lists.apache.org/thread.html/rfe55d83e4070bcc9285bbbf6bc39635dbcbba6d14d89aab0f339c83a@%3Ccommits.tez.apache.org%3E
- http://openwall.com/lists/oss-security/2017/08/31/4
Blast Radius: 23.7
Affected Packages
maven:org.asynchttpclient:async-http-client
Dependent packages: 611Dependent repositories: 1,449
Downloads:
Affected Version Ranges: < 2.0.35
Fixed in: 2.0.35
All affected versions: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.0.25, 2.0.26, 2.0.27, 2.0.28, 2.0.29, 2.0.30, 2.0.31, 2.0.32, 2.0.33, 2.0.34
All unaffected versions: 2.0.35, 2.0.36, 2.0.37, 2.0.38, 2.0.39, 2.0.40, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.6.0, 2.7.0, 2.8.0, 2.8.1, 2.9.0, 2.10.0, 2.10.1, 2.10.2, 2.10.3, 2.10.4, 2.10.5, 2.11.0, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 3.0.0