CVE-2022-31684
First published: Wed Oct 19 2022(Updated: )
A flaw was found in the Reactor Netty HTTP Server, which may log request headers in some cases of invalid HTTP requests. This could allow an attacker to access privileged information when WARN level logging is enabled.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Reactor Netty | >=1.0.11<=1.0.23 | |
| IBM Disconnected Log Collector | <=v1.0 - v1.8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/240579
- https://www.ibm.com/support/pages/node/7042313 (Advisory)
- https://tanzu.vmware.com/security/cve-2022-31684
- https://access.redhat.com/errata/RHSA-2022:8902
- https://access.redhat.com/security/cve/cve-2022-31684
- https://access.redhat.com/errata/RHSA-2023:4612
- https://bugzilla.redhat.com/show_bug.cgi?id=2141353
- https://www.cve.org/CVERecord?id=CVE-2022-31684 https://nvd.nist.gov/vuln/detail/CVE-2022-31684
Frequently Asked Questions
What is the severity of CVE-2022-31684?
The severity of CVE-2022-31684 is medium.
How does CVE-2022-31684 affect Tanzu VMware Reactor Netty?
CVE-2022-31684 affects Tanzu VMware Reactor Netty by allowing a remote authenticated attacker to obtain sensitive information.
How can an attacker exploit CVE-2022-31684?
An attacker can exploit CVE-2022-31684 by gaining access to the log file and obtaining valid access tokens information.
What is the affected software for CVE-2022-31684?
The affected software for CVE-2022-31684 includes Tanzu VMware Reactor Netty version up to and excluding 1.0.24, and IBM Disconnected Log Collector versions v1.0 to v1.8.2.
How can I fix CVE-2022-31684?
To fix CVE-2022-31684, update Tanzu VMware Reactor Netty to version 1.0.24 or apply the appropriate remedy from IBM for Disconnected Log Collector.
- collector/redhat-cve
- collector/nvd-index
- collector/ibm-support
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-31684
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/pivotal
- canonical/pivotal reactor netty
- version/pivotal reactor netty/1.0.11
- version/pivotal reactor netty/1.0.23
- vendor/ibm
- canonical/ibm disconnected log collector
- version/ibm disconnected log collector/v1.0 - v1.8.2
- package-manager/redhat