PT-2020-18460 · Project Reactor · Reactor Netty Httpclient

Daniel Spruth + 1 · Published 2020-03-03 · Updated 2022-02-10 · CVE-2020-5404

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Reactor Netty HttpClient versions 0.9.x prior to 0.9.5 Reactor Netty HttpClient versions 0.8.x prior to 0.8.16

Description The issue may lead to a credentials leak during a redirect to a different domain if the HttpClient is explicitly configured to follow redirects.

Recommendations For Reactor Netty HttpClient versions 0.9.x prior to 0.9.5, update to version 0.9.5 or later to resolve the issue. For Reactor Netty HttpClient versions 0.8.x prior to 0.8.16, update to version 0.8.16 or later to resolve the issue. As a temporary workaround, consider disabling the redirect follow configuration in the HttpClient until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-5404

GHSA-GPCH-H32J-GX6X

Affected Products

Reactor Netty Httpclient

References · 4

• https://osv.dev/vulnerability/GHSA-gpch-h32j-gx6x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5404 · Security Note
• https://pivotal.io/security/cve-2020-5404 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5404 · Vendor Advisory