REDHAT-BUG-2330004: High severity asynchttpclient vulnerability
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.
Affected Software
Event History
Frequently Asked Questions
Which applications are most exposed to this issue?
Java services using AsyncHttpClient that handle requests for multiple users are most exposed. The risk arises when cookies associated with one user remain in the library-managed CookieStore and are reused for another user's request.
Is the default configuration affected?
Yes. AsyncHttpClient's CookieStore is automatically enabled and self-managed. A cookie in that store silently replaces an explicitly defined cookie with the same name.
What conditions are required for incorrect cookie reuse?
A request must include an explicitly defined cookie whose name matches a cookie already present in the CookieStore. In a multi-user service, this can cause a stored cookie from one user's activity to be sent with another user's request.
How can I determine whether my service may be affected?
Review whether the service uses AsyncHttpClient, serves more than one user, and explicitly sets cookies on outbound requests. It may be affected if the automatically managed CookieStore can also contain cookies with those same names.