Homepage
About Snyk

com.linecorp.armeria:armeria@0.90.1 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the com.linecorp.armeria:armeria package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Incorrect Authorization

com.linecorp.armeria:armeria is an asynchronous HTTP/2 RPC/REST client/server library built on top of Java 8, Netty, Thrift and gRPC (armeria)

Affected versions of this package are vulnerable to Incorrect Authorization. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. The Armeria decorators might not be invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer.

How to fix Incorrect Authorization?

Upgrade com.linecorp.armeria:armeria to version 1.24.3 or higher.

[,1.24.3)
  • H
Directory Traversal

com.linecorp.armeria:armeria is an asynchronous HTTP/2 RPC/REST client/server library built on top of Java 8, Netty, Thrift and gRPC (armeria)

Affected versions of this package are vulnerable to Directory Traversal by sending an HTTP request whose path contains %2F (encoded /), such as /files/..%2Fsecrets.txt

How to fix Directory Traversal?

Upgrade com.linecorp.armeria:armeria to version 1.12.0 or higher.

[,1.12.0)
  • M
HTTP Response Splitting

com.linecorp.armeria:armeria is an asynchronous HTTP/2 RPC/REST client/server library built on top of Java 8, Netty, Thrift and gRPC (armeria)

Affected versions of this package are vulnerable to HTTP Response Splitting. It allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0.

How to fix HTTP Response Splitting?

Upgrade com.linecorp.armeria:armeria to version 0.97.0 or higher.

[0.85.0,0.97.0)
  • H
Timing Attack

com.linecorp.armeria:armeria is an asynchronous HTTP/2 RPC/REST client/server library built on top of Java 8, Netty, Thrift and gRPC (armeria)

Affected versions of this package are vulnerable to Timing Attack. This vulnerability is caused by the insecure implementation of equals method from java.lang.String.

How to fix Timing Attack?

Upgrade com.linecorp.armeria:armeria to version 0.96.0 or higher.

[0.34.0,0.96.0)
Go back to all versions of this package