Description
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.asynchttpclient:async-http-client | < 2.0.35 | 2.0.35 | GHSA-93jq-624g-4p9p |
References
- https://github.com/AsyncHttpClient/async-http-client/issues/1455
- RHSA-2018:2669 vendor-advisory
- http://openwall.com/lists/oss-security/2017/08/31/4
- [pulsar-commits] 20200914 [GitHub] [pulsar] klwilson227 opened a new issue #8061: CVE-2017-14063 mailing-list
- [pulsar-commits] 20200924 [GitHub] [pulsar] jiazhai closed issue #8061: CVE-2017-14063 mailing-list
- [pulsar-commits] 20200925 [GitHub] [pulsar] jiazhai closed issue #8061: CVE-2017-14063 mailing-list
- [tez-issues] 20201002 [jira] [Created] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201002 [jira] [Assigned] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-dev] 20201002 [jira] [Created] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201004 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201004 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201005 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201005 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201009 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201009 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201014 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201014 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201020 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201020 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201021 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201021 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201110 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201111 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- https://lists.apache.org/thread.html/r0a6b6429a7558051dbb70bd06584b4b1c334a80ec9203d3d39b7045a%40%3Ccommits.tez.apache.org%3E
- https://lists.apache.org/thread.html/rfe55d83e4070bcc9285bbbf6bc39635dbcbba6d14d89aab0f339c83a%40%3Ccommits.tez.apache.org%3E
- [tez-issues] 20201111 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-dev] 20201112 Build failed in Jenkins: Tez-qbt-0.10-Build #12 mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list