AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with Authorization: Basic, which carries the username and password base64 encoded and so recoverable by anyone who sees the request. Any of these is enough, sent by whoever...

GHSA-RQF5-2WXV-RJF4 AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge. The client then answers it with Authorization: Basic, which carries the username and password base64 encoded and so recoverable by anyone who sees the request. Any of these is enough, sent by whoever...