org.asynchttpclient:async-http-client-extras-parent vulnerabilities (TuxCare)
16 vulnerabilities.
org.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS6.8 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel5.9 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source3.7 Loworg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host9.4 Criticalorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk6.9 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext8.7 Highorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins7.4 Highorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)6.8 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled7.5 Highorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request5.9 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service7.5 Highorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target6.8 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore4.0 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareasync-http-client: Cookie header not stripped on cross-origin redirect7.4 Highorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects6.8 Mediumorg.asynchttpclient:async-http-client-extras-parentTuxCareAsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s9.2 Critical