REDHAT-BUG-2221626: Path Traversal

Published Jul 10, 2023

Updated

It was found that the ResponseBodyHandlers class implementation in the Networking/HTTP client component of OpenJDK failed to check for special characters embedded in file name parameters. A malicious user able to make a Java application perform an HTTP request to an attacker provided URL could use this flaw to possibly carry out a path traversal attack.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Jul 10, 2023

Data Sourced

via Red Hat·11:18 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2221626?

REDHAT-BUG-2221626 is classified as a moderate severity vulnerability.

How do I fix REDHAT-BUG-2221626?

To fix REDHAT-BUG-2221626, update your OpenJDK to the latest patched version as recommended by your vendor.

What impact does REDHAT-BUG-2221626 have?

REDHAT-BUG-2221626 allows a malicious user to exploit vulnerabilities in HTTP requests, potentially leading to arbitrary file access.

Which versions of OpenJDK are affected by REDHAT-BUG-2221626?

REDHAT-BUG-2221626 primarily affects OpenJDK 17.

How can I determine if my application is vulnerable to REDHAT-BUG-2221626?

You can determine vulnerability to REDHAT-BUG-2221626 by checking if your application makes HTTP requests that include user-controlled filenames.