REDHAT-BUG-1487563: Medium severity AsyncHttpClient async-http-client vulnerability

Q: Which deployments are affected?

Async Http Client versions before 2.0.35 are affected. The provided information does not identify any configuration-specific prerequisite.

Q: What input is required to trigger the issue?

An attacker must be able to cause processing of a URI containing a '?' character in its fragment identifier. This can make the client connect to a host different from the host extracted by java.net.URI.

Q: How can I determine whether my application is vulnerable?

Check the Async Http Client version in use. Versions earlier than 2.0.35 are affected according to the provided information.

Published Sep 1, 2017

Updated

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

Upstream issue:

https://github.com/AsyncHttpClient/async-http-client/issues/1455

Affected Software

1 affected component

AsyncHttpClient async-http-client<2.0.35

Event History

Sep 1, 2017

Data Sourced

via Red Hat·09:47 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Async Http Client versions before 2.0.35 are affected. The provided information does not identify any configuration-specific prerequisite.

What input is required to trigger the issue?

An attacker must be able to cause processing of a URI containing a '?' character in its fragment identifier. This can make the client connect to a host different from the host extracted by java.net.URI.

How can I determine whether my application is vulnerable?