Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
References
Configurations
History
07 Nov 2023, 02:38
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2017-08-31 16:29
Updated : 2024-02-28 16:04
NVD link : CVE-2017-14063
Mitre link : CVE-2017-14063
CVE.ORG link : CVE-2017-14063
JSON object : View
Products Affected
asynchttpclient_project
- async-http-client
CWE
CWE-20
Improper Input Validation