PT-2017-13228
CVE-2017-14063
·
تاريخ النشر
2017-08-31
·
تاريخ التحديث
2020-12-16
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Async Http Client versions prior to 2.0.35
Description
The issue allows Async Http Client to be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. This is similar to previously identified bugs in cURL and Oracle Java 8 java.net.URL.
Recommendations
For versions prior to 2.0.35, update to version 2.0.35 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾