org.asynchttpclient:async-http-client-extras-typesafe-config vulnerabilities (TuxCare)
16 vulnerabilities.
org.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS6.8 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel5.9 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source3.7 Loworg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host9.4 Criticalorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk6.9 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext8.7 Highorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins7.4 Highorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)6.8 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled7.5 Highorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request5.9 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service7.5 Highorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target6.8 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore4.0 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareasync-http-client: Cookie header not stripped on cross-origin redirect7.4 Highorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects6.8 Mediumorg.asynchttpclient:async-http-client-extras-typesafe-configTuxCareAsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s9.2 Critical