https://bugzilla.redhat.com/show_bug.cgi?id=1487563
Bug ID: 1487563
Summary: CVE-2017-14063 async-http-client: Ivalid URL parsing
with '?'
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
extras-orphan(a)fedoraproject.org, gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, msrb(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
rwagner(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into
connecting to a host different from the one extracted by java.net.URI if a '?'
character occurs in a fragment identifier. Similar bugs were previously
identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Upstream issue:
https://github.com/AsyncHttpClient/async-http-client/issues/1455
--
You are receiving this mail because:
You are on the CC list for the bug.