Description
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.
Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Reactor Netty | 1.1.0 – < 1.1.13, 1.0.0 – < 1.0.39, older unsupported versions | 1.1.13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | trino | 433-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.projectreactor.netty:reactor-netty-http | >= 1.1.0, < 1.1.13 | 1.1.13 | GHSA-xjhv-p3fv-x24r |
| Maven | io.projectreactor.netty:reactor-netty-http | >= 1.0.0, < 1.0.39 | 1.0.39 | GHSA-xjhv-p3fv-x24r |
Advisories 2
- WID-SEC-2024-1092 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 12, 2024
- WID-SEC-2024-0241 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 29, 2024