CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-0040
https://notcve.org/view.php?id=CVE-2023-0040
Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. • https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14063 – async-http-client: Invalid URL parsing with '?'
https://notcve.org/view.php?id=CVE-2017-14063
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL. Async Http Client (también async-http-client) en versiones anteriores a la 2.0.35 se puede engañar para que se conecte a otro host diferente del extraído por java.net.URI si existe el caracter '?' en un identificador de fragmento. • http://openwall.com/lists/oss-security/2017/08/31/4 https://access.redhat.com/errata/RHSA-2018:2669 https://github.com/AsyncHttpClient/async-http-client/issues/1455 https://lists.apache.org/thread.html/r04b15fd898a6b1612153543375daaa8145a0fd1804ec9fa2e0d95c97%40%3Cissues.tez.apache.org%3E https://lists.apache.org/thread.html/r0a6b6429a7558051dbb70bd06584b4b1c334a80ec9203d3d39b7045a%40%3Ccommits.tez.apache.org%3E https://lists.apache.org/thread.html/r14a74d204f285dd3a4fa203de6dbb4e741ddb7fdfff7915590e5b3db%40%3Cdev.tez.apache.org%3E https:/ • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-7398 – async-http-client: missing hostname verification for SSL certificates
https://notcve.org/view.php?id=CVE-2013-7398
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate. main/java/com/ning/http/client/AsyncHttpClientConfig.java en Async Http Client (también conocido como AHC o async-http-client) anterior a 1.9.0 no requiere una coincidencia de nombre de anfitrión durante la verificación de los certificados X.509, lo que permite a atacantes man-in-the-middle falsificar servidores HTTPS a través de un certificado válido arbitrario. It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name. • http://openwall.com/lists/oss-security/2014/08/26/1 http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html http://rhn.redhat.com/errata/RHSA-2015-1176.html http://rhn.redhat.com/errata/RHSA-2015-1551.html http://www.securityfocus.com/bid/69317 https://github.com/AsyncHttpClient/async-http-client/issues/197 https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E https://l • CWE-297: Improper Validation of Certificate with Host Mismatch CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-7397 – async-http-client: SSL/TLS certificate verification is disabled under certain conditions
https://notcve.org/view.php?id=CVE-2013-7397
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates. Async Http Client (también conocido como AHC o async-http-client) anterior a 1.9.0 salta la verificación los certificados X.509 a no ser que tanto una localización keyStore y una localización trustStore estén configuradas explícitamente, lo que permite a atacantes man-in-the-middle falsificar servidores HTTPS mediante la presentación de un certificado arbitrario durante el uso de una configuración AHC típica, tal y como fue demostrado por una configuración que no envía certificados de cliente. It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle (MITM) attacker could use this flaw to spoof a valid certificate. • http://openwall.com/lists/oss-security/2014/08/26/1 http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html http://rhn.redhat.com/errata/RHSA-2015-1176.html http://rhn.redhat.com/errata/RHSA-2015-1551.html http://www.securityfocus.com/bid/69316 https://github.com/AsyncHttpClient/async-http-client/issues/352 https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E https://l • CWE-295: Improper Certificate Validation CWE-345: Insufficient Verification of Data Authenticity •