Path Traversal

Reactor Netty HTTP Server is vulnerable to Path Traversal. The vulnerability is due to improper validation for file paths. An attacker can accesses unauthorized files or directories by using crafted URLs...

ai.optfor:spring-openai-api (>=0.2.2 <=0.3.25), be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-azure-blob-out (=2.12.0) +750 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.1.0 <=1.1.12)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.1.0, =0.2.2, =0.14.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0, =0.15.0-RC2 and more Source cves: CVE-2023-34062 Source advisory: OSV:GHSA-XJHV-P3FV-X24R...

In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

GHSA-XJHV-P3FV-X24R In Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

africa.absa:inception-application (>=1.0.0 <=1.2.0), ai.onehouse:lakeview (>=0.26.0 <=0.30.0) +2624 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.0.0 <=1.0.38)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.26.0, =0.26.0, =j11.2.6.0, =v0.3.12, =v0.3.12, =v0.3.12, =1.6, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.485 and more Source cves: CVE-2023-34062 Source advisory: OSV:GHSA-XJHV-P3FV-X24R...

CVE-2023-34062

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

CVE-2023-34062

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

CVE-2023-34062

CVE-2023-34062 affects Reactor Netty HTTP Server. Versions 1.1.x prior to 1.1.13 and 1.0.x prior to 1.0.39 are vulnerable when the server is configured to serve static resources. A crafted URL can trigger a directory traversal (path traversal) vulnerability, allowing access to restricted files. T...

CVE-2023-34062

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

PT-2023-8190

Name of the Vulnerable Software and Affected Versions Reactor Netty HTTP Server versions 1.0.x prior to 1.0.39 Reactor Netty HTTP Server versions 1.1.x prior to 1.1.13 Description The issue is related to incorrect restriction of directory path names, which can lead to a directory traversal attack...

Directory Traversal in Reactor Netty HTTP Server

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

VMware Reactor Netty Path Traversal Vulnerability

VMware Reactor Netty is a US-based VMware company that provides non-blocking and backpressure-ready TCP/HTTP/UDP/QUIC clients and servers based on the Netty framework. A security vulnerability exists in VMware Reactor Netty versions 1.1.x prior to 1.1.13 and 1.0.x prior to 1.0.39, which originate...

SSL hot reload in Spring Boot 3.2.0

In Spring Boot 3.2.0, we're adding the ability for embedded web servers to hot-reload SSL certificates and keys. That means you can rotate your SSL trust material without restarting your application. Hot reloading is supported for Tomcat and Netty embedded web servers. Let's see that in action!...

Security Bulletin: Due to use of Netty, IBM® MobileFirst Platform is vulnerable to a denial of service.

Summary Netty is used by IBM® MobileFirst Platform. CVE-2023-34462 Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS handshake the SniHandler class. By sending a...

Rocky Linux 8 : Satellite 6.11 Release (Moderate) (RLSA-2022:5498)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5498 advisory. - Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol serve...

Fedora: Security Advisory for wangle (FEDORA-2023-7934802344)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Netty network programming framework is related to errors during the verification of TLS certificates, which allow attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the Netty network programming framework is related to errors during the verification of TLS certificates. Exploiting this vulnerability allows a remote attacker to carry out a “man-in-the-middle” attack...

Security Bulletin: There is a vulnerability in netty used by IBM Maximo Asset Management (CVE-2023-34462)

Summary There is a vulnerability in netty used by IBM Maximo Asset Management CVE-2023-34462. Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS handshake the...

Security Bulletin: There is a vulnerability in netty used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-34462)

Summary There is a vulnerability in netty used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS...

SUSE SLED15: netty / netty-javadoc / netty-poms / netty-tcnative / etc (SUSE-SU-2023:4163-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4163-1 advisory. - Updated netty to version 4.1.100: - CVE-2023-44487: Fixed a potential denial of service scenario via RS...