Description
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Reactor Netty | prior to v0.8.11.RELEASE | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.projectreactor.netty:reactor-netty | < 0.8.11 | 0.8.11 | GHSA-j52r-xc68-q8f4 |