io.projectreactor.netty:reactor-netty-http 1.1.8 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the io.projectreactor.netty:reactor-netty-http package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
L Exposure of Sensitive System Information to an Unauthorized Control Sphere Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via handling of chained redirects. An attacker can cause the Reactor Netty HTTP client to leak credentials such as session cookies by intercepting initial HTTP/1.1 requests containing and replaying them on new HTTP/2 connections. Notes: For this to be exploited, the HTTP client must have been explicitly configured to follow redirects. For the commercial version of Spring, patches are also available for the 1.0.x and 1.1.x streams in 1.0.49 and 1.1.32 respectively. How to fix Exposure of Sensitive System Information to an Unauthorized Control Sphere? Upgrade `io.projectreactor.netty:reactor-netty-http` to version 1.2.8, 1.3.0-M5 or higher.	[0,1.2.8)[1.3.0-M1,1.3.0-M5)
H Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') when it is configured to serve static resources. An attacker can gain unauthorized access to directories and files by sending a specially crafted URL. How to fix Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')? Upgrade `io.projectreactor.netty:reactor-netty-http` to version 1.0.39, 1.1.13 or higher.	[,1.0.39)[1.1.0,1.1.13)

Vulnerability

Vulnerable Version

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via handling of chained redirects. An attacker can cause the Reactor Netty HTTP client to leak credentials such as session cookies by intercepting initial HTTP/1.1 requests containing and replaying them on new HTTP/2 connections.

Notes:

For this to be exploited, the HTTP client must have been explicitly configured to follow redirects.
For the commercial version of Spring, patches are also available for the 1.0.x and 1.1.x streams in 1.0.49 and 1.1.32 respectively.

How to fix Exposure of Sensitive System Information to an Unauthorized Control Sphere?

Upgrade io.projectreactor.netty:reactor-netty-http to version 1.2.8, 1.3.0-M5 or higher.

[0,1.2.8)[1.3.0-M1,1.3.0-M5)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') when it is configured to serve static resources. An attacker can gain unauthorized access to directories and files by sending a specially crafted URL.

How to fix Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')?

Upgrade io.projectreactor.netty:reactor-netty-http to version 1.0.39, 1.1.13 or higher.

[,1.0.39)[1.1.0,1.1.13)

io.projectreactor.netty:reactor-netty-http@1.1.8 vulnerabilities

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

How to fix?