PT-2017-13228 · Curl+1 · Curl+1

Publicado

2017-08-31

·

Atualizado

2020-12-16

·

CVE-2017-14063

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Async Http Client versions prior to 2.0.35
Description The issue allows Async Http Client to be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. This is similar to previously identified bugs in cURL and Oracle Java 8 java.net.URL.
Recommendations For versions prior to 2.0.35, update to version 2.0.35 or later to resolve the issue.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-14063
GHSA-93JQ-624G-4P9P

Produtos afetados

Oracle Java
Curl