CVE-2017-14063
EUVD-2018-055731.08.2017, 16:29
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| asynchttpclient_project | async-http-client | 𝑥 < 2.0.35 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References