GHSA-j52r-xc68-q8f4
Insufficiently Protected Credentials in Pivotal Reactor Netty
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.projectreactor.netty:reactor-netty | < 0.8.11 | 0.8.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
References
External links from the advisory. They lead to third-party sites.