CVE-2020-5404: Authentication Leak On Redirect With Reactor Netty HttpClient
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/reactor-nettyto a version that resolves this vulnerability.Fixed in 0.9.5 - Upgrade
Upgrade
redhat/reactor-nettyto a version that resolves this vulnerability.Fixed in 0.8.16 - Upgrade
Upgrade
Reactor Netty HttpClientto a version that resolves this vulnerability.Fixed in 0.9.5 - Upgrade
Upgrade
Reactor Netty HttpClientto a version that resolves this vulnerability.Fixed in 0.8.16 - Configuration
Ensure the Reactor Netty HttpClient is not explicitly configured to follow redirects, to prevent credential leakage during redirects to a different domain.
Reactor Netty HttpClient follow redirects (redirect handling) = disabled
Event History
Frequently Asked Questions
What is CVE-2020-5404?
CVE-2020-5404 is a vulnerability in the HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, that may lead to a credentials leak during a redirect to a different domain.
What is the severity of CVE-2020-5404?
The severity of CVE-2020-5404 is medium with a CVSS v3.1 score of 5.9.
How does CVE-2020-5404 occur?
CVE-2020-5404 occurs when the HttpClient from Reactor Netty is used incorrectly, leading to a credentials leak during a redirect to a different domain. This happens when the HttpClient is explicitly configured to follow redirects.
Which versions of Reactor Netty are affected by CVE-2020-5404?
Reactor Netty versions 0.9.x prior to 0.9.5 and versions 0.8.x prior to 0.8.16 are affected by CVE-2020-5404.
How can I remediate CVE-2020-5404?
To remediate CVE-2020-5404, upgrade to Reactor Netty version 0.9.5 or later if using version 0.9.x, or upgrade to version 0.8.16 or later if using version 0.8.x.