async-http-client vulnerabilities (Ubuntu)
26 vulnerabilities.
-
async-http-clientUbuntu AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink 5.8 Medium -
async-http-clientUbuntu AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS 6.8 Medium -
async-http-clientUbuntu AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel 5.9 Medium -
async-http-clientUbuntu AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check 3.7 Low -
async-http-clientUbuntu AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source 3.7 Low -
async-http-clientUbuntu AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host 9.4 Critical -
async-http-clientUbuntu AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities 7.6 High -
async-http-clientUbuntu AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk 6.9 Medium -
async-http-clientUbuntu AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int 8.8 High -
async-http-clientUbuntu AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT 7.5 High -
async-http-clientUbuntu AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext 8.7 High -
async-http-clientUbuntu AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins 7.4 High -
async-http-clientUbuntu AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts 4.0 Medium -
async-http-clientUbuntu AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) 6.8 Medium -
async-http-clientUbuntu AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled 7.5 High -
async-http-clientUbuntu AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified 3.7 Low -
async-http-clientUbuntu AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request 5.9 Medium -
async-http-clientUbuntu AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service 5.9 Medium -
async-http-clientUbuntu AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service 7.5 High -
async-http-clientUbuntu AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target 6.8 Medium -
async-http-clientUbuntu AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP 7.5 High -
async-http-clientUbuntu AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore 4.0 Medium -
async-http-clientUbuntu async-http-client: Cookie header not stripped on cross-origin redirect 7.4 High -
async-http-clientUbuntu AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects 6.8 Medium -
async-http-clientUbuntu AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s 9.2 Critical -
async-http-clientUbuntu Insufficient Verification of Data Authenticity in Async Http Client 4.3 Medium