CVE-2023-34054: Undefined Security Weakness

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.onehouse:lakeview (>=0.26.0, <=0.33.0) +2823 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.0.38)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.26.0, =0.26.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =1.3, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.496 and more Source cves: CVE-2023-34062 Source advisory: OSV:GHSA-XJHV-P3FV-X24R...

ai.optfor:spring-openai-api (>=0.2.2, <=0.3.25), be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-azure-blob-out (2.12.0) +1024 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.1.0, <=1.1.12)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.1.0, =0.2.2, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves: CVE-2023-34062 Source advisory:...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.onehouse:lakeview (>=0.26.0, <=0.33.0) +2823 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.0.38)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.26.0, =0.26.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =1.3, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.496 and more Source cves: CVE-2023-34062 Source advisory: GHSA-XJHV-P3FV-X24R...

ai.optfor:spring-openai-api (>=0.2.2, <=0.3.25), be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-azure-blob-out (2.12.0) +1024 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.1.0, <=1.1.12)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.1.0, =0.2.2, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves: CVE-2023-34062 Source advisory:...

africa.absa:inception-application (>=1.0.0, <=1.2.0), ai.onehouse:lakeview (>=0.26.0, <=0.33.0) +2823 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.0.0, <=1.0.38)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.0, =1.0.0, =0.26.0, =0.26.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =1.3, =3.1.242, =3.1.242, =3.1.242, =3.1.242, =3.1.496 and more Source cves: CVE-2023-34062 Source advisory: MEND:CVE-2023-34062...

ai.optfor:spring-openai-api (>=0.2.2, <=0.3.25), be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-azure-blob-out (2.12.0) +1024 more potentially affected by CVE-2023-34062 via io.projectreactor.netty:reactor-netty-http (>=1.1.0, <=1.1.12)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.1.0, =0.2.2, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves: CVE-2023-34062 Source advisory:...

CVE-2023-34062

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

CVE-2023-34062: Improper Limitation of a Pathname to a Restricted Directory

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Netty HTTP response splitting (CVE-2022-41915)

Summary Potential security bypass vulnerability in Netty-CVE-2022-41915 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-41915 DESCRIPTION: Netty is vulnerable to HTTP response...

FreeBSD : cassandra3 -- multiple vulnerabilities (53caf29b-9180-11ed-acbe-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 53caf29b-9180-11ed-acbe-b42e991fc52e advisory. - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI...

Moderate: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.18.3 release and security update

A minor version update from 3.14.5 to 3.18.3 is now available for Camel for Spring Boot. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common...

CVE-2022-31684

A flaw was found in the Reactor Netty HTTP Server, which may log request headers in some cases of invalid HTTP requests. This could allow an attacker to access privileged information when WARN level logging is enabled...

This Week in Spring - October 25th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! When last we spoke, I was in Las Vegas, NV, for the JavaOne show. It was amazing! Im in sunny Singapore, then off to Malaysia and Thailand. Its the first time Ive been to any of these places since 2019! How good it is to be...

africa.absa:inception-application (>=1.1.0, <=1.2.0), ai.ylyue:yue-library-webflux (>=j11.2.6.0, <=j11.2.6.1) +1519 more potentially affected by CVE-2022-31684 via io.projectreactor.netty:reactor-netty-http (>=1.0.11, <=1.0.23)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.11, =1.1.0, =j11.2.6.0, =v0.3.12, =v0.3.12, =v0.3.12, =1.7, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.496 and more Source cves: CVE-2022-31684 Source advisory: OSV:GHSA-7W4X-4H67-PGM...

africa.absa:inception-application (>=1.1.0, <=1.2.0), ai.ylyue:yue-library-webflux (>=j11.2.6.0, <=j11.2.6.1) +1519 more potentially affected by CVE-2022-31684 via io.projectreactor.netty:reactor-netty-http (>=1.0.11, <=1.0.23)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.11, =1.1.0, =j11.2.6.0, =v0.3.12, =v0.3.12, =v0.3.12, =1.7, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.496 and more Source cves: CVE-2022-31684 Source advisory: GHSA-7W4X-4H67-PGMV...

CVE-2022-31684

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...

Cross site request forgery (csrf)

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...

africa.absa:inception-application (>=1.1.0, <=1.2.0), ai.ylyue:yue-library-webflux (>=j11.2.6.0, <=j11.2.6.1) +1519 more potentially affected by CVE-2022-31684 via io.projectreactor.netty:reactor-netty-http (>=1.0.11, <=1.0.23)

io.projectreactor.netty:reactor-netty-http MAVEN version =1.0.11, =1.1.0, =j11.2.6.0, =v0.3.12, =v0.3.12, =v0.3.12, =1.7, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.305, =3.1.496 and more Source cves: CVE-2022-31684 Source advisory: MEND:CVE-2022-31684...

CVE-2022-31684

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...