Vulnerability Description
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Asynchttpclient Project | Async-Http-Client | < 2.0.35 |
Related Weaknesses (CWE)
References
- http://openwall.com/lists/oss-security/2017/08/31/4Mailing ListPatchThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2669Third Party Advisory
- https://github.com/AsyncHttpClient/async-http-client/issues/1455Issue TrackingPatchThird Party Advisory
- https://lists.apache.org/thread.html/r04b15fd898a6b1612153543375daaa8145a0fd1804
- https://lists.apache.org/thread.html/r0a6b6429a7558051dbb70bd06584b4b1c334a80ec9
- https://lists.apache.org/thread.html/r14a74d204f285dd3a4fa203de6dbb4e741ddb7fdff
- https://lists.apache.org/thread.html/r3df4b7ccc363b4850a24842138117aa4451b875bc4
- https://lists.apache.org/thread.html/r41a0e2c36f7d1854a4d56cb1e4aa720ef501782d88
- https://lists.apache.org/thread.html/r4ebb9596d890f3528630492bd78237b3eef06f093b
- https://lists.apache.org/thread.html/r5b8666c4414500ff6e993bfa69cb6afa19b1b67c45
- https://lists.apache.org/thread.html/r5f07c30721503d4c02d5451f77a611a1a0bb2a94dd
- https://lists.apache.org/thread.html/r5f794dc07913c5f2ec08f540813b40e61b562d36f8
- https://lists.apache.org/thread.html/r683d78c6d7a15659f2bb82dd4120dab8c45a870eaa
- https://lists.apache.org/thread.html/r7046a51116207588e36ca8c2e291327e391dae4071
- https://lists.apache.org/thread.html/r7879a48644f708be0529bd39f0679ad3ad951f3dc2
FAQ
What is CVE-2017-14063?
CVE-2017-14063 is a vulnerability with a CVSS score of 7.5 (HIGH). Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Si...
How severe is CVE-2017-14063?
CVE-2017-14063 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-14063?
Check the references section above for vendor advisories and patch information. Affected products include: Asynchttpclient Project Async-Http-Client.