medium5.9
CVE-2020-5404
Insufficiently Protected Credentials in Reactor Netty
Impact
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.projectreactor.netty:reactor-netty-http | >= 0.9.0, < 0.9.5 | 0.9.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Broadcom | Reactor Netty | from 0.8.0 through 0.8.15 from 0.9.0 through 0.9.4 |