Description
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Reactor Netty | 0.8 – < v0.8.16.RELEASE, 0.9 – < v0.9.5.RELEASE | v0.8.16.RELEASE |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.projectreactor.netty:reactor-netty-http | >= 0.9.0, < 0.9.5 | 0.9.5 | GHSA-gpch-h32j-gx6x |
| Maven | io.projectreactor.netty:reactor-netty-http | >= 0.8.0, < 0.8.16 | 0.8.16 | GHSA-gpch-h32j-gx6x |