GitStock

asynchttpclient/async-http-client · Security

Improper Input Validation in async-http-client

GHSA ID
GHSA-93jq-624g-4p9p
CVE ID
CVE-2017-14063
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v3
7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

CWEs

  • CWE-20 · Improper Input Validation

References