CVE-2017-14063 Improper Input Validation in async-http-client
HighCVSS 7.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.asynchttpclient/async-http-client(Maven) | < 2.0.35 | 2.0.35 |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC1 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC10 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC11 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC12 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC13 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC14 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC15 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC16 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC17 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC18 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC19 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC2 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC20 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC21 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC3 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC4 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC5 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC6 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC7 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC8 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-RC9 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha13 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha14 | No fix listed |
Show 48 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha15 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha16 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha17 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha18 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha19 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha20 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha21 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha22 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha23 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha24 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha25 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha26 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.0-alpha27 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.1 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.10 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.11 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.12 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.13 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.14 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.15 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.16 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.17 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.18 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.19 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.2 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.20 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.21 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.22 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.23 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.24 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.25 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.26 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.27 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.28 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.29 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.3 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.30 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.31 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.32 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.33 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.34 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.4 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.5 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.6 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.7 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.8 | No fix listed |
| org.asynchttpclient/async-http-client(Maven) | = 2.0.9 | No fix listed |
| asynchttpclient project async-http-client | < 2.0.35 | 2.0.35 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- RHSA-2018:2669 third-party-advisory vendor-advisory
- github.com vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- openwall.com mailing-list patch third-party-advisory
- Debian Security Tracker CVE-2017-14063 vendor-advisory
- github.com product
- [tez-issues] 20201002 [jira] [Created] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- lists.apache.org
- [tez-dev] 20201112 Build failed in Jenkins: Tez-qbt-0.10-Build #12 mailing-list
- [tez-issues] 20201014 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201110 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201020 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201111 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201111 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201021 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201004 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-dev] 20201002 [jira] [Created] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201004 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [pulsar-commits] 20200924 [GitHub] [pulsar] jiazhai closed issue #8061: CVE-2017-14063 mailing-list
- [tez-issues] 20201014 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201009 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201009 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201020 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201021 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [tez-issues] 20201002 [jira] [Assigned] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
- [pulsar-commits] 20200925 [GitHub] [pulsar] jiazhai closed issue #8061: CVE-2017-14063 mailing-list
- [tez-issues] 20201005 [jira] [Updated] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- [pulsar-commits] 20200914 [GitHub] [pulsar] klwilson227 opened a new issue #8061: CVE-2017-14063 mailing-list
- [tez-issues] 20201005 [jira] [Commented] (TEZ-4237) Upgrade async-http-client-1.9.40 due to CVE-2017-14063 mailing-list
- lists.apache.org